PT-2026-99107 · Unknown+1 · Pgpointcloud+1
CVE-2026-100387
·
Published
2026-09-25
·
Updated
2026-09-25
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
pgPointcloud versions prior to 1.2.6
Description
An issue exists in the dimensional patch WKB (Well-Known Binary) deserialization process. Authenticated database users can exploit this by providing crafted
pcpatch values with manipulated size fields. This allows the attacker to read adjacent heap memory—a region of memory used for dynamic allocation—which can be used to exfiltrate data into stored patches or cause the PostgreSQL backend to crash.Recommendations
Update pgPointcloud to version 1.2.6 or later.
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Postgresql
Pgpointcloud