Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-100387: pgpointcloud up to 1.2.5 lets logged‑in users read memory
CVE-2026-100387 · published 1 month ago
Summary
The pgpointcloud extension for PostgreSQL (versions up to 1.2.5) can be tricked by a signed‑in database user into reading data from nearby memory areas. This could expose internal information or cause the database service to stop working. Upgrade to a newer version of pgpointcloud or apply the vendor’s patch to stop the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| pgpointcloud | pointcloud | <= 1.2.5 |
Original advisory text
pgPointcloud through 1.2.5 heap out-of-bounds read via WKB deserialization
pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization that allows authenticated database users to read adjacent heap memory. Attackers can supply crafted pcpatch values with attacker-controlled size fields to copy heap memory into stored patches for exfiltration or crash the PostgreSQL backend.
References
- https://github.com/pgpointcloud/pointcloud Product
- https://github.com/pgpointcloud/pointcloud/blob/v1.2.5/lib/pc_bytes.c#L1347-L137... Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-1003... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-100387 Vendor Advisory
- https://github.com/pgpointcloud/pointcloud/issues/387 Third Party Advisory
- https://www.vulncheck.com/advisories/pgpointcloud-through-1.2.5-heap-out-of-boun... Vendor Advisory
- https://github.com/pgpointcloud/pointcloud/pull/388 Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
8.6
High
Type
CWE-125Out-of-bounds Read
Timeline
Published25 Sep 2026
Updated4 Nov 2026
First seen25 Sep 2026
Track software like this
Free during beta