---
id: CVE-2026-73515
title: >-
  PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that
  allows attackers to cause memory disclosure or a server crash by supplying a
  malformed FlatGeobuf buffer
summary: >-
  PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that
  allows attackers to cause memory disclosure or a server crash by supplying a
  malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies
  that …
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
cwe:
  - CWE-125
published: '2026-08-13'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:02:50.260'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73515'
references:
  - url: 'https://gitea.osgeo.org/postgis/postgis/raw/tag/3.7.0beta2/NEWS'
    label: disclosure@vulncheck.com
  - url: >-
      https://mehmetince.net/part-1-6-systemic-risks-in-the-managed-postgresql-industry-extension-risks-are-real-exploiting-postgis-memory-corruption-bug-at-neondb-supabase-and-many-more/
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/postgis-0beta2-out-of-bounds-read-via-flatgeobuf-buffer
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00566
epssPercentile: 0.44573
ingestedAt: '2026-09-24T20:51:40.200Z'
---

## Overview

PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.