CVE-2026-102639 MobilityDB through 1.3.0 Out-of-bounds Read DoS via WKB Deserialization
Unprivileged users can crash the PostgreSQL backend via crafted WKB payloads due to integer overflow in MobilityDB deserialization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-102639?
CVE-2026-102639 is a high-severity vulnerability in MobilityDB, published on 29 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic that allows unprivileged database users to crash the PostgreSQL backend process by supplying a crafted WKB payload with a negative length field. The negative length value wraps to a large unsigned size_t due to missing signed validation, bypasses an overflow-unsafe pointer arithmetic bounds check in wkb_parse_state_check(), and causes memcpy() in text_from_wkb_state() to operate with a corrupted unbounded length, resulting in a remote denial-of-service condition affecting all sessions on the PostgreSQL instance.
Weakness: CWE-195
Which versions are affected by CVE-2026-102639?
How do I fix CVE-2026-102639?
No fix has been published for CVE-2026-102639 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-102639 being exploited?
There is no known exploitation of CVE-2026-102639 in the wild and no public exploit code.
Sources
Also known as GHSA-2c92-2w7c-pm3g.