libspatialite through version 5.1.0 contains an integer overflow flaw (CWE‑190) and an out‑of‑bounds read vulnerability (CWE‑125) in the WKB geometry parsing routines. The overflow is triggered when the library parses a geometry blob with a point or vertex count larger than the internal guard, causing out‑of‑bounds reads. An attacker that can supply a crafted geometry BLOB—such as one stored in a SpatiaLite database—can trigger a crash or corrupt heap memory on 32‑bit builds, leading to service disruption or integrity violations.

The vulnerable component is libspatialite from the SpatiaLite project. Versions 5.1.0 and earlier are affected, with 32‑bit platforms exhibiting the strongest manifestation. The flaw is exercised during normal parsing of WKB geometries, which can occur when opening or querying a database file.

The CVSS base score of 6.9 denotes moderate severity. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to provide a malicious geometry blob, which could be delivered via a crafted database file or through an application that loads untrusted data with libspatialite. The integer overflow and resulting out‑of‑bounds read can compromise application stability and memory, delivering denial of service or potential integrity compromise.