EUVD-2026-89198Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via the Postgres protocol (AV:N/AC:L), any low-privileged DB user can call the input function (PR:L), single crafted value with no user interaction, availability-only crash (A:H) with no C/I impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic that allows unprivileged database users to crash the PostgreSQL backend process by supplying a crafted WKB payload with a negative length field. The negative length value wraps to a large unsigned size_t due to missing signed validation, bypasses an overflow-unsafe pointer arithmetic bounds check in wkb_parse_state_check(), and causes memcpy() in text_from_wkb_state() to operate with a corrupted unbounded length, resulting in a remote denial-of-service condition affecting all sessions on the PostgreSQL instance.
AnalysisAI
Denial of service in MobilityDB 1.3.0 and earlier allows an authenticated PostgreSQL database user with the MobilityDB extension installed to crash the backend process - and thereby terminate all sessions on that instance - by supplying a crafted Well-Known Binary (WKB) payload with a negative length field. Exploitation requires only a valid low-privileged database login (CVSS AV:N/PR:L) and the ability to invoke a binary input path such as ttextFromBinary, ttextFromHexWKB, COPY ... …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated PostgreSQL account with the ability to invoke a binary WKB input path on a MobilityDB-enabled database (version 1.3.0 or earlier): the binary input functions ttextFromBinary or ttextFromHexWKB, the binary receive functions used by COPY ... … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded-severity issue: a CWE-195 signed/unsigned conversion error in MobilityDB/MEOS WKB deserialization where a negative length field wraps to a large size_t, defeats an overflow-unsafe bounds check in wkb_parse_state_check(), and drives an out-of-bounds memcpy() in text_from_wkb_state() that crashes the PostgreSQL backend. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to MobilityDB v1.3.1 (https://github.com/MobilityDB/MobilityDB/releases/tag/v1.3.1) or v1.2.2 (https://github.com/MobilityDB/MobilityDB/releases/tag/v1.2.2), compile and install the new binaries, then run the extension upgrade inside each affected database with ALTER EXTENSION mobilitydb UPDATE TO '1.3.1';. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Vendor-released patch: MobilityDB v1.3.1 and v1.2.2. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Same weakness CWE-195 – Signed to Unsigned Conversion Error
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today