CVE-2026-73514 PostGIS CVE debrief

Who should care

Defenders and database administrators using PostGIS with the address_standardizer extension should assess exposure and prioritize patching, especially in environments where untrusted users have database access.

Why it matters

The out-of-bounds write vulnerability in PostGIS address_standardizer extension requires immediate attention from defenders and database administrators. It allows a database user to trigger memory corruption, potentially leading to database crashes or unexpected behavior. Verification of patch application and monitoring of database activity are necessary to prevent exploitation.

• Memory corruption can occur, potentially leading to database crashes or unexpected behavior
• An attacker could exploit this vulnerability to execute arbitrary code or cause denial-of-service conditions
• Verification of patch application and monitoring of database activity are necessary to prevent exploitation
• Remediation priority is high due to the potential for memory corruption and database instability

Technical summary

The address_standardizer extension for PostGIS through 3.7.0 contains an out-of-bounds write vulnerability. A database user with the ability to supply caller-controlled relation names to standardize_address() can trigger memory corruption by providing a rules table with a classification Type value exceeding the fixed class range. The vulnerability requires immediate attention from defenders and database administrators. Verification of patch application and monitoring of database activity are necessary to prevent exploitation.

Defensive priority

Defenders should prioritize verifying and applying patches for the address_standardizer extension in PostGIS, especially in environments where untrusted users have database access.

Recommended defensive actions

• Verify and apply patches for the address_standardizer extension in PostGIS
• Restrict database access to trusted users
• Monitor database activity for suspicious queries
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE record and NVD entry. Details are also provided in several source references, including GitHub commits and a blog post. The CVE record was published on 2026-08-13T16:19:05.190Z and has not been modified since then. The vulnerability affects PostGIS through 3.7.0, fixed in commit 423570b. The out-of-bounds write vulnerability allows a database user to trigger memory corruption by providing a rules table with a classification Type value exceeding the fixed class range.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.