CVE-2026-73515: Postgis

High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days.

PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.

Affected products

• Postgis Postgis: before 3.7.0beta2 (fixed in 3.7.0beta2)

Published 2026-08-13. Last modified 2026-09-24.