Libspatialite
Monthly
An integer overflow in libspatialite's WKB geometry parser - the point/vertex count size guard in ParseWkbLine and related routines in gg_wkb.c - lets a crafted geometry BLOB with an oversized declared point count slip past the bounds check, resulting in out-of-bounds reads. Any application that links libspatialite 5.1.0 or earlier and opens untrusted spatial data, most commonly a SpatiaLite database file, is affected: triggering the flaw crashes the process, and on 32-bit builds the same overflow can corrupt heap memory. The vector is local and file-driven (CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H), so exploitation requires the victim or an automated ingest pipeline to parse an attacker-supplied file; no public exploit code and no confirmed active exploitation were identified at time of analysis.
libspatialite through 5.1.0 can be driven into uncontrolled memory allocation and denial of service when it parses a crafted polygon WKB geometry whose interior-ring count is not checked against the BLOB contents. The issue is reachable through malicious SpatiaLite databases or untrusted input passed to ST_GeomFromWKB, requires user interaction to load the crafted data, and can crash the process; on 32-bit builds the resulting heap corruption may be more severe. No CISA KEV entry or public exploit code was identified in the supplied intelligence, and the assessed impact is local denial of service with limited integrity impact.
An integer overflow in libspatialite's WKB geometry parser - the point/vertex count size guard in ParseWkbLine and related routines in gg_wkb.c - lets a crafted geometry BLOB with an oversized declared point count slip past the bounds check, resulting in out-of-bounds reads. Any application that links libspatialite 5.1.0 or earlier and opens untrusted spatial data, most commonly a SpatiaLite database file, is affected: triggering the flaw crashes the process, and on 32-bit builds the same overflow can corrupt heap memory. The vector is local and file-driven (CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H), so exploitation requires the victim or an automated ingest pipeline to parse an attacker-supplied file; no public exploit code and no confirmed active exploitation were identified at time of analysis.
libspatialite through 5.1.0 can be driven into uncontrolled memory allocation and denial of service when it parses a crafted polygon WKB geometry whose interior-ring count is not checked against the BLOB contents. The issue is reachable through malicious SpatiaLite databases or untrusted input passed to ST_GeomFromWKB, requires user interaction to load the crafted data, and can crash the process; on 32-bit builds the resulting heap corruption may be more severe. No CISA KEV entry or public exploit code was identified in the supplied intelligence, and the assessed impact is local denial of service with limited integrity impact.