CVE-2026-90775: PostGIS address_standardizer through 3.7.0 Out-of-Bounds Read via Unvalidated Rule Weight
PostGIS addressstandardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the loadvalue array, causing the PostgreSQL backend process to crash and terminate all cluster sessions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to supply or modify rows in rules tables used by address_standardizer. The vulnerable Weight value is caller-controlled through those rule rows.
What is the operational impact of successful exploitation?
A malicious out-of-range Weight value can cause an out-of-bounds read in the load_value array and crash the PostgreSQL backend process. The crash terminates all sessions in the PostgreSQL cluster.
Are default installations affected?
The available information does not establish whether default rules tables contain attacker-controlled or out-of-range Weight values. Exposure depends on whether an untrusted or insufficiently validated party can create or alter rules consumed by address_standardizer.
What can be done before patching?
Restrict creation and modification of address_standardizer rules tables to trusted administrators, and validate Weight values before rules are loaded or used. Do not allow untrusted users to submit rule rows with out-of-range Weight values.