CVE-2026-73515: 
PostgreSQL vulnerability analysis and mitigation

CVE-2026-73515 is an out-of-bounds read vulnerability in PostGIS affecting all versions before 3.7.0beta2. The flaw resides in the FlatGeobuf property metadata decoder, which validates the presence of a string length field but fails to verify that the subsequent string body is fully contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service. It was published on August 13, 2026, with a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 7.2 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-125 (Out-of-bounds Read). The FlatGeobuf property metadata decoder in PostGIS performs an incomplete bounds check: it confirms that a string length field exists within the buffer but does not validate that the full string body (as indicated by that length) is also contained within the buffer boundaries before reading and exposing it as a SQL value. An authenticated attacker with low privileges can supply a crafted malformed FlatGeobuf buffer via a network-accessible PostGIS function, triggering the out-of-bounds read. A technical write-up detailing exploitation against managed PostgreSQL providers (NeonDB, Supabase, and others) is available at mehmetince.net (GitHub Advisory, VulnCheck Advisory).

Successful exploitation allows an authenticated attacker to read memory contents beyond the intended buffer boundary, potentially exposing sensitive data from the PostgreSQL server process memory — including credentials, query results, or other in-memory data. Additionally, the malformed buffer can cause a server crash, resulting in denial of service for all users of the affected PostGIS/PostgreSQL instance. The vulnerability has no integrity impact but carries high confidentiality and availability impacts, and is particularly significant in multi-tenant managed PostgreSQL environments where cross-tenant memory disclosure is a concern (GitHub Advisory, Red Hat Bugzilla).

The NVD SSVC assessment classifies exploitation status as "poc," indicating a proof-of-concept exists, though Feedly's executive summary notes no confirmed public PoC or active in-the-wild exploitation at the time of publication. The EPSS score is approximately 0.41% (35th percentile), reflecting a relatively low near-term exploitation probability. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE. The vulnerability requires low-privilege authentication, making it accessible to any database user with permission to invoke FlatGeobuf-processing functions (GitHub Advisory, VulnCheck Advisory).

1. Reconnaissance: Identify PostGIS installations running versions prior to 3.7.0beta2, particularly in managed PostgreSQL environments (e.g., NeonDB, Supabase). Confirm PostGIS is installed and accessible via SELECT PostGIS_version();.
2. Obtain low-privilege access: Acquire database credentials with at least low-privilege access — this may include free-tier accounts on managed PostgreSQL platforms.
3. Craft malformed FlatGeobuf buffer: Construct a FlatGeobuf binary buffer where the property metadata string length field indicates a string body larger than the remaining buffer size, causing the decoder to read beyond the buffer boundary.
4. Submit malformed buffer: Pass the crafted buffer to a PostGIS function that processes FlatGeobuf data (e.g., ST_FromFlatGeobuf or equivalent), triggering the out-of-bounds read.
5. Observe result: If the server does not crash (DoS), the out-of-bounds memory contents may be materialized as a SQL-visible string value, disclosing server process memory. Repeated attempts with varying offsets can be used to map additional memory regions (GitHub Advisory, VulnCheck Advisory).

• Logs: PostgreSQL server logs showing unexpected crashes or segmentation faults in PostGIS-related functions; error messages referencing FlatGeobuf decoding or memory access violations in postgresql.log.
• Logs: Repeated invocations of FlatGeobuf-processing PostGIS functions (e.g., ST_FromFlatGeobuf) by low-privilege users, especially with unusually short or malformed binary inputs.
• Network: Unusual or repeated database connections from external IPs submitting binary geometry data to PostGIS functions.
• Process: PostgreSQL backend process crashes (postmaster restart events) correlated with FlatGeobuf function calls, visible in system logs or monitoring dashboards.

The primary remediation is to upgrade PostGIS to version 3.7.0beta2 or later, which contains the fix for the incomplete bounds check in the FlatGeobuf property metadata decoder (GitHub Advisory, PostGIS NEWS). As interim workarounds, administrators should implement network-level and database-level access controls to restrict which users can invoke FlatGeobuf-processing functions, and revoke unnecessary privileges from low-trust users. Monitoring server logs for crash events or anomalous FlatGeobuf function invocations is also recommended until patching is complete (Red Hat Bugzilla).

Red Hat has tracked this vulnerability under Bugzilla bug 2515434 with high severity and is assessing impact on affected products (Red Hat Bugzilla). Security researcher Mehmet İnce published a detailed write-up highlighting the systemic risks of PostGIS extensions in managed PostgreSQL environments, demonstrating exploitation impact at providers such as NeonDB and Supabase (Researcher Blog). VulnCheck also published an advisory covering the vulnerability (VulnCheck Advisory).