CVE-2026-73515: postgis Out-of-bounds Read

Vulnerability summary

CVE-2026-73515 is a high (CVSS 8.1) Out-of-bounds Read vulnerability in postgis. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 45.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 13-08-2026
   PublishedVulnerability first disclosed.
2. 14-08-2026
   Last modifiedVulnerability information updated.

Description

PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.