This vulnerability in PostGIS address_standardizer before version 3.7.1 allows a malicious user to insert rule table entries with Weight values that exceed the expected bounds. The unchecked Weight is used as an array index, causing an out‑of‑bounds read in the load_value array during rule processing. The resulting memory access violation crashes the PostgreSQL backend process, bringing down the entire database cluster and terminating all active sessions. The weakness is a classic out‑of‑bounds read (CWE‑125).

All installations of PostGIS address_standardizer version 3.7.0 and earlier are vulnerable. The flaw applies to the address_standardizer module used by PostgreSQL for normalizing street addresses. The vulnerability is not limited to any specific platform or configuration and affects any database instance that loads or executes arbitrary rule tables via address_standardizer.

The CVSS base score of 7.1 indicates a high severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed or widely known exploits yet. A threat actor would need to supply address_standardizer enabled and sufficient privileges to load the table. Failure to validate the Weight value permits the attacker to trigger a crash cluster.