EUVD-2026-58108
GHSA-qv7r-wgc7-6mc6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via SQL connection with PR:L required; no integrity impact; memory disclosure and crash map to C:H and A:H respectively.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.
AnalysisAI
Out-of-bounds read in PostGIS before 3.7.0beta2 enables low-privileged database users to disclose server process memory or crash the PostgreSQL backend by passing malformed FlatGeobuf geometry data to the extension's property metadata decoder. The decoder validates that a string length prefix is present but omits a bounds check confirming the string body falls within the supplied buffer before materializing it as a SQL-visible value, creating both a memory disclosure and denial-of-service path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker requires a low-privilege authenticated database session on a PostgreSQL instance with the PostGIS extension installed, plus EXECUTE permission on a FlatGeobuf-consuming function such as ST_FromFlatGeobuf. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.2 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H accurately captures the threat profile: network-reachable with low attack complexity and no special attack requirements, constrained only by the need for a low-privilege database credential, yielding high confidentiality and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a low-privilege PostgreSQL connection - or an application whose input pipeline passes user-controlled geometry data into a PostGIS FlatGeobuf function - crafts a FlatGeobuf buffer in which the property string length field names a size exceeding the remaining buffer bytes. When ST_FromFlatGeobuf or an equivalent function processes this buffer, the decoder reads beyond the end of the supplied data, returning adjacent server process heap contents as a SQL result row or triggering a backend crash. … |
| Remediation | Upgrade PostGIS to version 3.7.0beta2 or later, which resolves the missing bounds check in the FlatGeobuf property string decoder as confirmed in the release NEWS at https://gitea.osgeo.org/postgis/postgis/raw/tag/3.7.0beta2/NEWS. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all instances running PostGIS versions prior to 3.7.0beta2 and audit which roles have access to PostGIS functions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today