CVE-2026-100387
pgPointcloud through 1.2.5 heap out-of-bounds read via WKB deserialization
pgpointcloud pointcloud
CVSS
7.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization that allows authenticated database users to read adjacent heap memory. Attackers can supply crafted pcpatch values with attacker-controlled size fields to copy heap memory into stored patches for exfiltration or crash the PostgreSQL backend.
Text from CVE List
Affected versions 1
- pointcloudaffected: all versions through 1.2.5CVE List
References 5
- github.com/pgpointcloud/pointcloud/pull/388Fixvia CVE List
- vulncheck.com/advisories/pgpointcloud-through-1.2.5-heap-out-of-bounds-read-via-wkb-deserializationAdvisoryvia CVE List
- github.com/pgpointcloud/pointcloud/issues/387Referencevia CVE List
- github.com/pgpointcloud/pointcloud/blob/v1.2.5/lib/pc_bytes.c#L1347-L1373Referencevia CVE List
- github.com/pgpointcloud/pointcloudReferencevia CVE List