The address_standardizer extension for PostGIS is vulnerable to an out-of-bounds write that occurs when the standardize_address() function is supplied with user-controlled relation names and a rules table entry whose classification Type value exceeds the expected range. The oversized type value is used directly as an index into an internal output-link table without bounds checking, causing a memory corruption that may allow the affected user to overwrite adjacent data structures. This flaw can compromise confidentiality, integrity, and availability of the database by enabling arbitrary memory writes.

The flaw affects the address_standardizer extension versions up to and including 3.7.0 running on PostgreSQL databases. Any database user that has permission to supply caller-controlled relation names to the standardize_address() function can potentially trigger the vulnerability. The affected products are the PostGIS geospatial extension for PostgreSQL.

The CVSS score of 8.7 indicates high severity. No EPSS score is available, and the vulnerability is not yet listed in CISA KEV, but the lack of remediation and the local nature of the trigger mean that authorized users could exploit it without needing external access. Attackers may target databases where the extension is deployed and where users can create or supply rules tables with improper classification types. The risk is significant for systems that rely on address_standardizer for data validation or geocoding.