PostGIS CVE-2026-73515

The attacker requires a low-privilege authenticated database session on a PostgreSQL instance with the PostGIS extension installed, plus EXECUTE permission on a FlatGeobuf-consuming function such as ST_FromFlatGeobuf. No non-default PostGIS configuration is needed - the vulnerable code path is exercised whenever the FlatGeobuf parser is called with attacker-controlled input, which is the default behavior of the function. Exploitation is blocked without database authentication; unauthenticated network access alone is insufficient. However, this condition is effectively met for any authenticated tenant on managed multi-tenant PostgreSQL services (NeonDB, Supabase) where PostGIS is a standard offering and tenant credentials grant exactly this level of access. Memory disclosure outcome is non-deterministic and dependent on heap layout at the time of the read; a backend crash may occur instead of disclosure if the out-of-bounds address is unmapped, resulting in denial of service rather than data leakage.

The CVSS 4.0 score of 7.2 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H accurately captures the threat profile: network-reachable with low attack complexity and no special attack requirements, constrained only by the need for a low-privilege database credential, yielding high confidentiality and availability impact. The PR:L requirement does limit opportunistic unauthenticated mass exploitation, but in multi-tenant managed PostgreSQL environments (NeonDB, Supabase) every tenant is effectively a low-privilege user with PostGIS accessible by default, making the constraint nearly moot for those platforms. A public exploit and a detailed researcher blog post confirming successful exploitation against major managed services substantially elevate risk beyond the raw score; EPSS data was not provided but the combination of public POC, accessible attack complexity, and cloud-service exposure warrants high-priority treatment for affected deployments. No CISA KEV listing is present, so widespread automated exploitation is not confirmed. The CVSS 4.0 VI:N metric correctly reflects no integrity impact - this is a read-only memory disclosure, not a write primitive.

An attacker holding a low-privilege PostgreSQL connection - or an application whose input pipeline passes user-controlled geometry data into a PostGIS FlatGeobuf function - crafts a FlatGeobuf buffer in which the property string length field names a size exceeding the remaining buffer bytes. When ST_FromFlatGeobuf or an equivalent function processes this buffer, the decoder reads beyond the end of the supplied data, returning adjacent server process heap contents as a SQL result row or triggering a backend crash. The published researcher blog post at mehmetince.net confirms this technique yields memory disclosure against NeonDB and Supabase, with heap contents potentially including query results, session tokens, or other sensitive in-memory data; a publicly available exploit exists.