The address_standardizer extension in PostGIS versions up to 3.7.0 contains an out-of-bounds write vulnerability triggered by a specially crafted rules table entry. A database user with the ability to supply caller-controlled relation names to the standardize_address() function can provide a classification Type value exceeding the expected range. This value is used unchecked as an index into an internal output-link table, causing memory corruption via an out-of-bounds write. The issue was fixed in commit 423570b, but no explicit patch release information is provided. The vulnerability has a CVSS 4.0 score of 8.7, indicating high impact with network attack vector, low attack complexity, no privileges required beyond database user, and no user interaction needed.

Successful exploitation can lead to memory corruption within the PostGIS address_standardizer extension, potentially causing denial of service or other unpredictable behavior in the database environment. The vulnerability requires the attacker to have database user privileges with the ability to supply relation names to the standardize_address() function. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was fixed in commit 423570b, so upgrading to a version including this fix is recommended once available. Until then, restrict database user permissions to prevent supplying malicious relation names to the standardize_address() function.