CVE-2026-73514: Out-of-Bounds Write in PostGIS address_standardizer

The address_standardizer extension for PostGIS, commonly used for parsing and standardizing address data, contains an out-of-bounds write vulnerability identified as CVE-2026-73514. The vulnerability exists in all versions up to and including 3.7.0 and is addressed in commit 423570b. The issue arises when the standardize_address() function processes a caller-supplied rules table.

An attacker with authenticated access to the database - specifically one who can create or modify tables used as rules by the extension - can supply a 'Type' value that exceeds the intended fixed range. The extension fails to perform bounds checking on this value before using it as an index into an internal output-link table. This results in an out-of-bounds memory write, which can be leveraged to corrupt memory, cause a denial-of-service (crash), or potentially achieve arbitrary code execution within the database process context. This vulnerability is particularly relevant to environments where low-privileged users are granted the ability to create database objects or manipulate data used by administrative extensions.

Impact

Successful exploitation of this vulnerability allows an authenticated attacker to compromise the integrity of the database process memory. This can lead to service instability, database crashes, or potential escalation of privileges via code execution. The scope of impact is limited to database users with sufficient permissions to manipulate tables passed to the standardize_address() function.

Recommendation

1. Upgrade the PostGIS address_standardizer extension to a version containing the fix implemented in commit 423570b.
2. Audit database permissions to identify users with the ability to create or modify tables that are utilized as input for the standardize_address() function.
3. Implement strict access controls on the PostGIS extension functions to ensure only trusted users can invoke standardize_address() with custom-defined rules tables.
4. Monitor database logs for repeated errors or unexpected restarts of the PostgreSQL service, which may indicate crash attempts associated with exploitation of this vulnerability.