CVE-2026-112048: Memory Allocation with Excessive Size Value in SpatiaLite libspatialite

The vulnerability in libspatialite (up to version 5.1.0) arises from failure to validate the polygon ring count in the ParseWkbPolygon function. This allows attackers to trigger excessive interior-ring memory allocation by providing specially crafted geometry BLOBs. Exploitation can occur through crafted polygon inputs in SpatiaLite databases or ST_GeomFromWKB calls, leading to crashes or heap corruption on 32-bit builds. The CVSS 4.0 base score is 6.9, indicating a medium severity with local attack vector, low attack complexity, no privileges required, and user interaction needed.

Successful exploitation can cause application crashes or heap memory corruption on 32-bit systems using vulnerable libspatialite versions. This may result in denial of service or potential memory corruption issues, but no direct code execution or data disclosure is indicated.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted polygon data in libspatialite or restrict usage to trusted inputs.