Description

The address_standardizer extension for PostGIS through 3.7.0, fixed in commit 423570b, contains an out-of-bounds write vulnerability that allows a database user with the ability to supply caller-controlled relation names to standardize_address() to trigger memory corruption by providing a rules table with a classification Type value exceeding the fixed class range. Attackers can craft a malicious rules table entry with an oversized rule type value that is used without bounds checking as an index into an internal output-link table, resulting in an out-of-bounds write.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T16:19:05.190Z",
  "pubdate": "2026-08-13T16:19:05.190Z",
  "executiveSummary": "An out-of-bounds write vulnerability exists in the address_standardizer extension for PostGIS through version 3.7.0. The vulnerability allows a database user with the capability to supply caller-controlled relation names to the standardize_address() function to trigger memory corruption. This occurs by providing a maliciously crafted rules table containing a classification Type value that exceeds the fixed class range.\nThe impact of this vulnerability includes potential memory corruption and unauthorized system state manipulation within the database server context. The affected systems are PostgreSQL database instances utilizing PostGIS with the address_standardizer extension enabled up to version 3.7.0. Risk implications involve potential arbitrary code execution or denial of service depending on the memory layout and exploitation sophistication.\nAttacker capabilities require database user privileges, specifically the ability to supply caller-controlled relation names and create or control a rules table used by the standardize_address() function. Exploitation requirements include authenticated database access and the creation of a malformed rules table entry featuring an oversized rule type value that bypasses expected boundaries.",
  "technicalDetails": "The root cause of the vulnerability resides in the address_standardizer extension component of PostGIS, specifically within the handling of classification Type values supplied via rules tables to the standardize_address() function. The vulnerable component fails to perform adequate bounds checking on the classification Type value read from the rules table entries.\nDuring the execution of standardize_address(), the application utilizes the classification Type value as an index directly into an internal output-link table without validating whether the index falls within the allocated bounds of the target array or buffer. Consequently, when an attacker supplies a rules table containing an oversized rule type value, the lack of bounds validation results in an out-of-bounds write operation, leading directly to memory corruption.\nThe attack flow proceeds as follows: First, an authenticated database user with sufficient privileges creates or modifies a rules table to include a malicious entry where the classification Type value exceeds the fixed class range. Second, the attacker invokes the standardize_address() function, passing the attacker-controlled relation names or the malicious rules table as an argument. Third, the extension parses the rules table, reads the oversized classification Type value, and uses it as an unchecked array index into the internal output-link table. Fourth, the write operation targets an unintended memory address outside the boundaries of the output-link table, causing memory corruption.\nThe vulnerability affects PostGIS through version 3.7.0, specifically impacting the address_standardizer extension. Authentication and privilege requirements mandate that the attacker must be a database user capable of supplying caller-controlled relation names and executing the standardize_address() function. Network exposure is limited to the database interface, but the exploit is driven by database-level inputs rather than direct network packets."
}