CVE-2026-100387: pgPointcloud through 1.2.5 heap out-of-bounds read via WKB deserialization
pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization that allows authenticated database users to read adjacent heap memory. Attackers can supply crafted pcpatch values with attacker-controlled size fields to copy heap memory into stored patches for exfiltration or crash the PostgreSQL backend.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated database user who can supply crafted pcpatch values is required. The issue is remotely reachable, but it does not require user interaction.
What can a successful exploit do?
A crafted dimensional patch WKB value can cause adjacent heap memory to be copied into stored patches, allowing memory disclosure through exfiltration. It can also crash the PostgreSQL backend.
What input condition triggers the vulnerability?
The attacker supplies pcpatch values with attacker-controlled size fields during dimensional patch WKB deserialization. Those fields can cause a heap out-of-bounds read.
Which versions are affected?
pgPointcloud versions through 1.2.5 are affected. The provided information does not identify a fixed release version.