CVE-2026-73515

PostGIS before 3.7.0beta2 is affected by an out-of-bounds read in the FlatGeobuf metadata decoder, allowing memory disclosure or server crash when processing a malformed FlatGeobuf buffer. The root cause is the decoder not verifying that the string body lies within the supplied buffer before mate...