Skip to main content

address_standardizer EUVDEUVD-2026-58107

| CVE-2026-73514 HIGH
Out-of-bounds Write (CWE-787)
2026-08-13 VulnCheck GHSA-7xxg-v5x5-6wjr
Memory Corruption Buffer Overflow Address Standardizer Suse
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Network-reachable via database connection (AV:N), low complexity once DB access is obtained (AC:L), requires authenticated low-privilege database user with schema write rights (PR:L), no scope change as impact is confined to the PostgreSQL backend process.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 13, 2026 - 16:38 vuln.today
Analysis Generated
Aug 13, 2026 - 16:38 vuln.today
CVE Published
Aug 13, 2026 - 15:36 cve.org
HIGH 8.7

DescriptionCVE.org

The address_standardizer extension for PostGIS through 3.7.0, fixed in commit 423570b, contains an out-of-bounds write vulnerability that allows a database user with the ability to supply caller-controlled relation names to standardize_address() to trigger memory corruption by providing a rules table with a classification Type value exceeding the fixed class range. Attackers can craft a malicious rules table entry with an oversized rule type value that is used without bounds checking as an index into an internal output-link table, resulting in an out-of-bounds write.

AnalysisAI

Out-of-bounds write in the PostGIS address_standardizer extension through 3.7.0 allows a low-privileged database user to trigger memory corruption in the PostgreSQL server process by supplying a malicious rules table to the standardize_address() function. Missing bounds validation on the classification Type field in gamma.c permits values outside the valid range to be used as raw array indices into an internal output-link table, writing attacker-influenced data to adjacent memory. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate as low-privilege database user
Delivery
Create rules table with out-of-range classification Type value
Exploit
Call standardize_address() with attacker-controlled table name as rules argument
Execution
Trigger missing bounds check in gamma.c rules_add_rule() or create_rules()
Persist
Out-of-bounds write corrupts adjacent PostgreSQL backend process memory
Impact
Achieve memory corruption enabling data exfiltration, integrity violation, or process crash
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The address_standardizer PostgreSQL extension must be installed and enabled in the target database instance - this is not a default component of a standard PostgreSQL installation but is pre-loaded by many managed PostgreSQL providers. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N with High confidentiality, integrity, and availability impact on the vulnerable system) accurately captures the threat: a network-reachable, low-complexity attack requiring only a low-privilege database user account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A low-privileged PostgreSQL user creates a rules table containing a row with a classification Type value of 5 or higher (or a negative value), both of which exceed the MAX_CL boundary in the address_standardizer code. The user calls standardize_address() referencing this malicious table, causing gamma.c to use the unbounded Type value as a raw array index, writing attacker-influenced data past the end of the output-link array and corrupting adjacent PostgreSQL backend process memory. …
Remediation The primary fix is to apply upstream commit 423570b (https://github.com/postgis/address_standardizer/commit/423570b0dbf6cd9f6fc36de28a636e7b6e9aa8aa), which adds bounds validation at both vulnerable call sites in gamma.c. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all PostgreSQL instances and identify systems running PostGIS address_standardizer v3.7.0 or earlier; prioritize managed cloud PostgreSQL deployments and verify database access levels for low-privileged users. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Memory Corruption

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important

Share

EUVD-2026-58107 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy