PostGIS versions prior to 3.7.0beta2 contain an out-of-bounds read vulnerability that allows a maliciously crafted FlatGeobuf buffer to trigger a memory disclosure or a server crash. The vulnerability arises because the FlatGeobuf property metadata decoder verifies the presence of a string length field but does not ensure that the subsequent string data resides entirely within the supplied buffer, leading to CWE‑125.

All installations of the PostGIS extension that use a version older than 3.7.0beta2 are affected. This includes every PostGIS deployment that has not applied the 3.7.0beta2 update or newer.

The CVSS score of 7.2 indicates a moderate to high severity. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV. The attack vector is not explicitly described in the advisory, but the flaw is activated by supplying a malformed FlatGeobuf buffer to the PostGIS decoder; consequently an attacker would need access to execute queries or load FlatGeobuf data against the affected database, making it likely a local or remote database‑injection‐style attack where the attacker can supply the vulnerable data.