Description

PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-13T16:19:05.333Z",
  "pubdate": "2026-08-13T16:19:05.333Z",
  "executiveSummary": "PostGIS before version 3.7.0beta2 contains an out-of-bounds read vulnerability within the FlatGeobuf property metadata decoder.\nThe flaw allows attackers to supply a malformed FlatGeobuf buffer, resulting in memory disclosure or a denial of service via a server crash.\nThe vulnerability affects PostGIS systems processing untrusted FlatGeobuf spatial data inputs.\nRisk implications include the potential leakage of sensitive memory contents and operational disruption through application crashes.\nAn attacker must be capable of supplying a specially crafted, malformed FlatGeobuf buffer to the vulnerable database functions to achieve exploitation.",
  "technicalDetails": "The root cause of the vulnerability resides in the FlatGeobuf property metadata decoder component of PostGIS.\nWhile the decoder verifies that a string length field is present within the provided input, it fails to perform adequate bounds checking to verify that the subsequent string body is fully contained within the supplied buffer before attempting to materialize the data into a SQL-visible value.\nAffected versions include PostGIS prior to 3.7.0beta2.\nExploitation occurs when an attacker crafts a malicious FlatGeobuf payload where the specified string length exceeds the remaining bounds of the allocated buffer.\nDuring the attack flow, the parser reads past the end of the input buffer during string body extraction due to the missing boundary validation.\nThis out-of-bounds memory read can expose adjacent memory contents to the query context, leading to unauthorized memory disclosure.\nAlternatively, reading unmapped memory regions triggers a segmentation fault or memory access violation, causing an immediate database server crash and resulting in a denial of service.\nNo specific authentication or privilege requirements are inherently defined by the flaw itself, as exposure depends on how database functions ingest untrusted spatial buffers provided by users."
}