CVE-2026-73515

A flaw was found in PostGIS. This out-of-bounds read vulnerability allows a remote attacker to cause memory disclosure or a server crash. This occurs when a malformed FlatGeobuf buffer is supplied, as the FlatGeobuf property metadata decoder fails to verify that the string body is contained within the buffer. This can lead to sensitive information disclosure or a denial of service.

This vulnerability is rated as Important because an authenticated remote user can read out-of-bounds process memory or crash PostgreSQL backend workers, leading to high confidentiality and availability impacts. In typical Red Hat Enterprise Linux environments, PostGIS is an optional spatial database extension that is not enabled by default, requiring an administrator to explicitly install the package and activate the extension within a database. Although exploitation requires existing database connection privileges, the risk is elevated in shared or multi-tenant database deployments where unauthorized access to residual backend memory could compromise sensitive cross-session data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.