CVE-2026-112052: Integer Overflow or Wraparound in SpatiaLite libspatialite

CVE-2026-112052 is an integer overflow or wraparound vulnerability in libspatialite versions up to 5.1.0. The issue occurs in the WKB point and vertex count size guard within the ParseWkbLine function and related parsers in gg_wkb.c. An attacker can supply a specially crafted geometry BLOB containing a large point count, such as in a SpatiaLite database file, which triggers out-of-bounds reads. On 32-bit builds, this can lead to process crashes or heap memory corruption.

The vulnerability can cause denial of service through process crashes or memory corruption on 32-bit systems when processing maliciously crafted geometry data. There is no indication of privilege escalation or remote code execution. The CVSS 4.0 score is 6.9 (medium severity), reflecting local attack vector with low complexity and no privileges required but requiring user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted SpatiaLite database files containing geometry BLOBs with large point counts, especially on 32-bit systems.