CVE-2026-73515
Received Received - Intake

Out-of-Bounds Read in PostGIS via Malformed FlatGeobuf Buffer

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73515
EUVD
EUVD-2026-58108

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
postgis postgis to 3.7.0beta2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73515 is an out-of-bounds read vulnerability in PostGIS versions before 3.7.0beta2. It occurs in the FlatGeobuf property metadata decoder, which fails to verify if a string body is fully contained within the provided buffer before processing it. Attackers can exploit this by supplying a malformed FlatGeobuf buffer to cause memory disclosure or a server crash.

Detection Guidance

To detect this vulnerability, monitor for crashes or memory disclosure events in PostGIS services processing FlatGeobuf data. Check logs for malformed buffer errors or out-of-bounds read warnings. No specific commands are provided in the context.

Impact Analysis

This vulnerability can allow attackers to read sensitive memory contents or crash the server, leading to denial of service. If exploited, it may expose confidential data or disrupt database operations, particularly in environments using PostGIS with FlatGeobuf functionality.

Mitigation Strategies

Upgrade PostGIS to version 3.7.0beta2 or later to address the vulnerability. If immediate upgrade is not possible, restrict access to FlatGeobuf processing functions or disable FlatGeobuf support temporarily.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73515. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart