libspatialite EUVD-2026-103514

Exploitation requires the victim to open or parse an attacker-supplied geometry BLOB - for example a crafted SpatiaLite database file - using an application that links libspatialite 5.1.0 or earlier; the malicious BLOB must declare a large WKB point/vertex count that overflows the size guard in ParseWkbLine and related parsers in gg_wkb.c. Key limiting factors: it is a local, file-driven vector (no network reachability), it requires user interaction or an automated pipeline that ingests untrusted spatial files, and memory corruption (as opposed to a mere crash) is called out as occurring on 32-bit builds - 64-bit builds are expected to see denial of service rather than exploitable heap corruption.

This is a moderate, not top-priority, issue for most defenders. The vendor-assigned CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H, score 6.9) describes a local, file-driven flaw: an attacker cannot reach it over a network and must get a victim to process a crafted geometry BLOB or SpatiaLite database file (UI:P passive interaction). The dominant impact is availability (process crash / DoS) with a secondary low integrity impact from heap corruption, and notably no confidentiality impact despite the bug being an out-of-bounds READ - the vendor evidently judged that read primitive as crash/corruption rather than data exfiltration, which is worth verifying since OOB reads can sometimes leak adjacent heap memory. The description explicitly scopes memory corruption to 32-bit builds, so on modern 64-bit deployments the realistic outcome is a crash/DoS rather than exploitable corruption. No EPSS score, no CISA KEV listing, and no confirmed public exploit code were provided, so there is no evidence of active or widespread exploitation; a detailed third-party technical write-up (hackmd) and a VulnCheck advisory exist, which raises the chance of weaponization over time but is not itself an exploit. Net: a legitimate bug to patch on the normal cycle, elevated only for software that auto-ingests untrusted SpatiaLite/geometry files, especially 32-bit builds.

An attacker crafts a SpatiaLite database or WKB geometry BLOB declaring an inflated point/vertex count, then delivers it to a victim (e.g., a GIS analyst or an automated import pipeline) who opens or processes it with an application linking libspatialite ≤5.1.0. The integer overflow in the count size guard in gg_wkb.c defeats the bounds check, causing an out-of-bounds read that crashes the process, or on a 32-bit build corrupts the heap. No public exploit code was identified at time of analysis, though a detailed technical write-up exists.