CVE-2026-73515 is an out-of-bounds read in PostGIS's FlatGeobuf decoder. The parser validates that a string length field exists but never checks whether the referenced string data actually resides within the input buffer. When the length field claims more bytes than the buffer contains, the decoder reads past the end of the input into heap memory. This is a bounds-check omission, not a complex logic error — the developer added the length field validation but failed to add the corresponding pointer-arithmetic check for the string body itself.
The severity is amplified by PostGIS running inside the PostgreSQL backend process. An out-of-bounds read in this context doesn't just crash the query — it can leak heap contents belonging to other database sessions, including query data, authentication tokens, or connection state from concurrent users. This transforms what would be a modest vulnerability in an isolated CLI tool into a multi-tenant data exposure risk.
To verify if you're affected: confirm your PostGIS build includes FlatGeobuf support (PostGIS 2.5.0 through unpatched versions of later branches). Check yourPostGIS version with SELECT PostGIS_Full_Version();. If you're on a vulnerable version, your database is exposed any time a query invokes ST_FromFlatGeobuf or ST_FromFlatGeobufToGeobuf with untrusted input.
Immediate action: upgrade to the patched version. Beyond patching, audit any other format decoders in your PostGIS installation for the same pattern — length fields validated without corresponding body-bounds checks. This is a recurring vulnerability class in spatial and network parsers. If your deployment uses PostGIS with untrusted query sources (any web-facing application using PostGIS functions), treat this as higher-priority than the base CVSS suggests, because the PostgreSQL shared-address-space architecture widens the actual impact beyond what the score captures.