CVE-2026-73515

Name of the Vulnerable Software and Affected Versions PostGIS versions prior to 3.7.0beta2

Description An out-of-bounds read occurs when the FlatGeobuf property metadata decoder verifies the presence of a string length field but fails to ensure the subsequent string body is within the supplied buffer before converting it into a SQL-visible value. This flaw allows an attacker to provide a malformed FlatGeobuf buffer to cause memory disclosure or a server crash, leading to a denial of service.

Recommendations Update PostGIS to version 3.7.0beta2 or later.