MobilityDB versions up to 1.3.0 contain an out‑of‑bounds read in the MEOS binary during WKB deserialization (CWE-195). A malicious user can supply a crafted Well‑Known Binary payload whose length field is negative. The negative value is interpreted as a large unsigned number because the deserializer lacks signed validation, allowing the parser to bypass an overflow‑unsafe pointer arithmetic bounds check. A subsequent memcpy reads beyond the buffer, causing the PostgreSQL backend process to crash. The crash results in a remote denial‑of‑service affecting all database sessions.

The affected product is MobilityDB, the PostgreSQL extension for geospatial queries. All releases up to and including 1.3.0 are impacted; this includes earlier 1.2.x releases such as 1.2.2. The vulnerability is present only when using the MEOS library for WKB deserialization.

The CVSS score of 7.1 indicates a high severity denial‑of‑service risk. EPSS is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation is feasible from any unprivileged database user with permission to insert or query WKB data. An attacker can craft a negative length payload and trigger the crash without requiring elevated privileges. Mitigation depends on applying the patch or upgrade published in the MobilityDB 1.3.1 release.