{"id":"CVE-2026-90775","summary":"PostGIS address_standardizer through 3.7.0 Out-of-Bounds Read via Unvalidated Rule Weight","details":"PostGIS address_standardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the load_value array, causing the PostgreSQL backend process to crash and terminate all cluster sessions.","modified":"2026-09-15T08:11:00.715311Z","published":"2026-09-13T11:07:30.689Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90775.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90775.json"},{"type":"ADVISORY","url":"https://github.com/postgis/address_standardizer/blob/e987949e0fccff6a0e7a6d3f86814d5c7a01f481/NEWS.md"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90775"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/postgis-address-standardizer-through-3.7.0-out-of-bounds-read-via-unvalidated-rule-weight"},{"type":"FIX","url":"https://github.com/postgis/address_standardizer/commit/a5cb4b1360a040973092f13b1af97a718e7e104a"},{"type":"FIX","url":"https://github.com/postgis/address_standardizer/commit/e987949e0fccff6a0e7a6d3f86814d5c7a01f481"},{"type":"FIX","url":"https://github.com/postgis/address_standardizer/pull/6"},{"type":"PACKAGE","url":"https://github.com/postgis/address_standardizer"},{"type":"ARTICLE","url":"https://github.com/postgis/address_standardizer/blob/v3.7.0/src/analyze.c#L860"},{"type":"ARTICLE","url":"https://github.com/postgis/address_standardizer/blob/v3.7.0/src/gamma.c#L301-L311"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/postgis/address_standardizer","events":[{"introduced":"0"},{"fixed":"fa11ff53eb49b863d9ffff37f6afd5ff9299c581"},{"fixed":"a5cb4b1360a040973092f13b1af97a718e7e104a"},{"fixed":"e987949e0fccff6a0e7a6d3f86814d5c7a01f481"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"3.7.0"}]}}],"versions":["v3.7.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90775.json","vanir_signatures_modified":"2026-09-15T08:11:00Z","vanir_signatures":[{"source":"https://github.com/postgis/address_standardizer/commit/fa11ff53eb49b863d9ffff37f6afd5ff9299c581","target":{"file":"src/address_standardizer.c","function":"debug_standardize_address"},"deprecated":false,"digest":{"length":3616,"function_hash":"310506951008264446587210304497951151757"},"id":"CVE-2026-90775-19b9a13d","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/address_standardizer.c"},"deprecated":false,"digest":{"line_hashes":["14064042082914719957995780970075966614","236945478507379489297572981162242406697","66439846191087393758917437313737124263"],"threshold":0.9},"id":"CVE-2026-90775-7ff76562","signature_type":"Line","signature_version":"v1","source":"https://github.com/postgis/address_standardizer/commit/fa11ff53eb49b863d9ffff37f6afd5ff9299c581"},{"signature_version":"v1","source":"https://github.com/postgis/address_standardizer/commit/a5cb4b1360a040973092f13b1af97a718e7e104a","target":{"file":"src/gamma.c","function":"rules_add_rule"},"deprecated":false,"digest":{"function_hash":"324331152320715458342157204001316232450","length":2646},"id":"CVE-2026-90775-d5b2e8ec","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/postgis/address_standardizer/commit/a5cb4b1360a040973092f13b1af97a718e7e104a","target":{"file":"test/rules_api_test.c","function":"main"},"deprecated":false,"digest":{"function_hash":"188243978486517309826233423493510365155","length":588},"id":"CVE-2026-90775-d70d918a","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/postgis/address_standardizer/commit/a5cb4b1360a040973092f13b1af97a718e7e104a","target":{"file":"test/rules_api_test.c"},"deprecated":false,"digest":{"line_hashes":["233657289406279500591883522183655211902","41064157733298120940532563904143057947","197795327656426170346576384715147899301","70761908714737026347685408125068163739","264546486935088047164591752635743957507","293519306467019070279129168220803168013","17228013239636895655093931771271070221","207263626913730031863121802246858214692","196744348090418937431495287133418419760","119108620651563060104166691129394023752","164828296710210751274924968397961293393","81114721065690643951063630330565663938","12381346692669871934164006249909396090","329272971267261059493824345301947320792","206243177958724148032371779644839267579"],"threshold":0.9},"id":"CVE-2026-90775-edfd2970"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}