CVE-2026-73514 in PostGIS
Summary
by MITRE • 08/13/2026
The address_standardizer extension for PostGIS through 3.7.0, fixed in commit 423570b, contains an out-of-bounds write vulnerability that allows a database user with the ability to supply caller-controlled relation names to standardize_address() to trigger memory corruption by providing a rules table with a classification Type value exceeding the fixed class range. Attackers can craft a malicious rules table entry with an oversized rule type value that is used without bounds checking as an index into an internal output-link table, resulting in an out-of-bounds write.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/13/2026
The address_standardizer extension for PostGIS represents a critical component within spatial database systems that processes and standardizes address information for geospatial applications. This vulnerability exists in versions through 3.7.0 and was subsequently addressed in commit 423570b, highlighting the importance of proper input validation in database extensions that handle user-supplied data. The flaw specifically manifests when a database user with privileges to provide caller-controlled relation names invokes the standardize_address() function, creating a potential attack vector that leverages the extension's internal data structures.
The technical implementation of this vulnerability stems from inadequate bounds checking within the address standardization process. When processing rules tables, the system accepts a classification Type value that should be constrained to a fixed class range but fails to validate whether this value remains within acceptable parameters. This unchecked input is then directly used as an index into an internal output-link table structure without proper boundary verification, creating a scenario where maliciously crafted rule entries can cause memory corruption through out-of-bounds write operations.
The operational impact of this vulnerability extends beyond simple memory corruption, potentially enabling arbitrary code execution or system instability within database environments that utilize PostGIS address standardization features. Attackers can exploit this weakness by constructing malicious rules table entries containing oversized rule type values that exceed the expected bounds, effectively bypassing normal input validation mechanisms. This allows them to manipulate internal data structures and potentially achieve privilege escalation or denial of service conditions that could compromise entire database systems.
Security practitioners should consider this vulnerability in relation to CWE-787 which specifically addresses out-of-bounds write conditions, and its potential mapping to ATT&CK technique T1059.005 for command and scripting interpreter usage. The remediation strategy involves implementing proper input validation mechanisms that enforce bounds checking on classification Type values before they are used as array indices. Database administrators should immediately upgrade to patched versions of PostGIS and implement strict access controls to limit which users can create or modify rules tables, while also monitoring for unusual patterns in address standardization operations that might indicate exploitation attempts.
Additional mitigation measures include implementing database-level security controls such as role-based access restrictions on the standardize_address() function and regular auditing of rules table modifications. Organizations should also consider network segmentation and intrusion detection systems to monitor for suspicious database activity patterns that could indicate exploitation of this vulnerability. The fix implemented in commit 423570b demonstrates the importance of proper bounds checking in database extension development, particularly when dealing with user-supplied data that will be used as indexing parameters in internal data structures.