{"id":"CVE-2026-73515","title":"PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer","summary":"PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that …","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cwe":["CWE-125"],"published":"2026-08-13","updated":"2026-09-24","sourceUpdated":"2026-09-24T20:02:50.260","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73515","references":[{"url":"https://gitea.osgeo.org/postgis/postgis/raw/tag/3.7.0beta2/NEWS","label":"disclosure@vulncheck.com"},{"url":"https://mehmetince.net/part-1-6-systemic-risks-in-the-managed-postgresql-industry-extension-risks-are-real-exploiting-postgis-memory-corruption-bug-at-neondb-supabase-and-many-more/","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/postgis-0beta2-out-of-bounds-read-via-flatgeobuf-buffer","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.00566,"epssPercentile":0.44573,"ingestedAt":"2026-09-24T20:51:40.200Z","slug":"CVE-2026-73515","body":"## Overview\n\nPostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}