The address_standardizer extension for PostGIS through version 3.7.0 contains an out-of-bounds write vulnerability. A database user who can supply caller-controlled relation names to the standardize_address() function can exploit this by providing a rules table entry with a classification Type value exceeding the expected fixed class range. This oversized value is used unchecked as an index into an internal output-link table, causing memory corruption via an out-of-bounds write. The issue was resolved in commit 423570b.

Successful exploitation can lead to memory corruption, which may cause crashes or potentially allow an attacker to execute arbitrary code with the privileges of the database user. The vulnerability requires the attacker to have the ability to supply relation names and craft malicious rules table entries, which implies some level of database access but not necessarily administrative privileges.

A fix for this vulnerability is available in the PostGIS project as of commit 423570b. Users should update to a version of PostGIS that includes this fix. Since no official patch version or advisory is provided in the input data, users should consult the PostGIS vendor advisory or repository to identify the fixed version and apply the update accordingly. Until patched, restrict database user permissions to prevent supplying caller-controlled relation names to standardize_address() and avoid using untrusted rules tables.