MinorCritical vulnerability

CVE-2026-100387 (CVSS 7.2)

NVD · officialPublished Sep 25, 2026Risk 23/100

pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization that allows authenticated database users to read adjacent heap memory. Attackers can supply crafted pcpatch values with attacker-controlled size fields to copy heap memory into stored patches for exfiltration or crash the PostgreSQL backend.

Technical details

CVSS

7.2

AV:NetworkAC:LowPR:LowUI:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source