Heap Out-of-Bounds Read in pgPointcloud by pgPointcloud Project

CVE-2026-100387

What is CVE-2026-100387?

pgPointcloud through version 1.2.5 is susceptible to a heap out-of-bounds read during the deserialization of dimensional patch Well-Known Binary (WKB) data. This vulnerability allows authenticated database users to manipulate pcpatch values, leading to the potential reading of adjacent heap memory. Such exploitation could facilitate unauthorized data exfiltration or even crash the PostgreSQL backend by providing specially crafted size fields that can disrupt normal operations.

References