CVE-2026-73514

CVE-2026-73514 is a missing bounds check in PostGIS address_standardizer that allows an out-of-bounds array write when processing a maliciously crafted rules table. The vulnerability is straightforward at the code level: a Type value from the rules table is used directly as an array index without validating it falls within expected bounds. The fix in commit 423570b adds that validation. What makes this CVE unusual is the persistence mechanism. Most SQL injection or input validation bugs are transient — malicious data arrives, gets processed, and is gone. Here, the rules table is persistent state. An attacker writes a malicious entry once, and every subsequent call to standardize_address() that references that rules table walks through the poisoned code path. This transforms the attack from a one-time injection into a contamination event. If you run PostGIS, your priority actions are: first, apply the patch immediately — the fix is a simple bounds check and should be straightforward. Second, audit your existing rules tables in the public schema. A malicious entry planted before patching will still trigger the out-of-bounds write even after the code fix is deployed. Query your rules tables and verify no unexpected Type values exist that would exceed valid array bounds. The CVSS 8.8 rating hinges on whether unprivileged database users can create tables in your PostGIS instance. If standard users can create tables that address_standardizer might reference, exploitation is straightforward. If rules table creation requires elevated privileges, this becomes an insider threat rather than a remote exposure. Check your permission model and restrict rules table creation accordingly until patched. Beyond patching, audit other PostGIS extensions for similar patterns — extensibility features that accept caller-supplied relation names and treat them as trusted configuration without validating the relation was created by an administrator.

Reviewed through automated stages and approved by a human before publication.