Pointcloud
Monthly
Heap out-of-bounds reads in pgPointcloud through 1.2.5 allow an authenticated PostgreSQL user who can supply or store pcpatch values to copy bytes from adjacent backend heap memory into a persisted patch, enabling information disclosure or a backend crash (CVSS 4.0 base 7.2, CWE-125). The defect lives in dimensional patch WKB deserialization, where an attacker-controlled dimension size field is trusted without being validated against the remaining buffer length; exploitation requires a valid database session, the pgPointcloud extension installed, and the ability to insert or construct pointcloud-typed values. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and an upstream fix is available via pull request 388.
Heap out-of-bounds reads in pgPointcloud through 1.2.5 allow an authenticated PostgreSQL user who can supply or store pcpatch values to copy bytes from adjacent backend heap memory into a persisted patch, enabling information disclosure or a backend crash (CVSS 4.0 base 7.2, CWE-125). The defect lives in dimensional patch WKB deserialization, where an attacker-controlled dimension size field is trusted without being validated against the remaining buffer length; exploitation requires a valid database session, the pgPointcloud extension installed, and the ability to insert or construct pointcloud-typed values. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and an upstream fix is available via pull request 388.