Critical Memory Disclosure Vulnerabilities in PostgreSQL PostGIS

• •CVE-2026-73515 affects PostgreSQL PostGIS versions 16, 17, and 18.
• •CISA confirms active exploitation of these vulnerabilities in the wild.
• •Immediate patching is recommended for affected systems to prevent memory disclosure and denial of service.

Multiple memory disclosure vulnerabilities have been identified in PostgreSQL PostGIS versions 16, 17, and 18, affecting Fedora 43 and 44. These vulnerabilities, tracked as CVE-2026-73515, allow for potential denial of service and memory disclosure via malformed FlatGeobuf buffers. CISA has confirmed active exploitation of these vulnerabilities in the wild, prompting urgent advisories for system administrators to apply patches. The vulnerabilities affect systems using PostgreSQL with PostGIS extensions, which are widely used in geographic information systems. The issues were first published on August 13, 2026, and have been backported in recent updates. Administrators are advised to upgrade their systems immediately to mitigate the risks associated with these vulnerabilities.