[Mobilitydb-dev] Coordinated Vulnerability Disclosure - MobilityDB / MobilityDB

Tue Sep 29 10:59:32 PDT 2026

Hey Esteban,

We greatly appreciate your rapid response throughout this process. We've
updated and published the record based on your feedback above.

Thank you,

On Tue, Sep 29, 2026 at 1:04 PM Esteban Zimanyi <estebanzimanyi at gmail.com>
wrote:

> Hello,
>
> Thank you for reserving CVE-2026-102639 and for the draft record, which is
> accurate. The fix is now published, and we would ask for these changes:
>
> 1. Affected versions: 1.1.0 through 1.1.2 (no fix is planned for the 1.1
> series), 1.2.0 before 1.2.2, and 1.3.0 before 1.3.1. The fixed releases are
> 1.2.2 and 1.3.1.
> 2. References:
>    -
> https://github.com/MobilityDB/MobilityDB/security/advisories/GHSA-2c92-2w7c-pm3g
>    - https://github.com/MobilityDB/MobilityDB/releases/tag/v1.3.1
>    - https://github.com/MobilityDB/MobilityDB/releases/tag/v1.2.2
>    - https://github.com/MobilityDB/MobilityDB/pull/2867
>    - https://github.com/MobilityDB/MobilityDB/pull/2865
>    - https://github.com/MobilityDB/MobilityDB/pull/2866
> 3. Title: "MobilityDB through 1.3.0 Out-of-bounds Read DoS via WKB
> Deserialization".
> 4. Description: the same flaw also affects applications that link the MEOS
> library and read untrusted WKB.
>
> Best regards,
>
> Esteban
>
> ------------------------------------------------------------
> Prof. Esteban Zimanyi
> Department of Computer & Decision Engineering  (CoDE) CP 165/15
> Universite Libre de Bruxelles
> Avenue F. D. Roosevelt 50
> B-1050 Brussels, Belgium
> fax: + 32.2.650.47.13 <+32%202%20650%2047%2013>
> tel: + 32.2.650.31.85 <+32%202%20650%2031%2085>
> e-mail: esteban.zimanyi at ulb.be
> Internet: http://cs.ulb.ac.be/members/esteban/
> ------------------------------------------------------------
>
>
> On Tue, Sep 29, 2026 at 5:57 PM Brandon Tarr <btarr at vulncheck.com> wrote:
>
>> Hey Esteban,
>>
>> We have provisionally reserved the following CVE for this vulnerability:
>> *CVE-2026-102639*.
>>
>> Credit is awarded to *Harsh Raj Singhania* as the finder.
>>
>> Additionally, I've attached the proposed CVE Record to this email, please
>> review it and let us know if anything needs to be changed.
>>
>> Thank you,
>>
>> On Tue, Sep 29, 2026 at 11:37 AM Esteban Zimanyi <
>> estebanzimanyi at gmail.com> wrote:
>>
>>> Hello,
>>>
>>> Thank you for the report and for coordinating the disclosure.
>>>
>>> We have reproduced the issue and confirmed the root cause described in
>>> the report. The Well-Known Binary (WKB) bounds check in
>>> meos/src/temporal/type_in.c added the requested length to the parse
>>> position, so a negative or very large length read from the input, such as
>>> the length of a text value, wrapped the pointer and passed the check. The
>>> only other guard was an assertion, which release builds compile out. With
>>> the reporter's payload, AddressSanitizer reports negative-size-param
>>> (size=-1) in text_from_wkb_state.
>>>
>>> The fix compares every read with the bytes remaining in the buffer,
>>> rejects a negative or oversized length or count before it is used, checks
>>> that the type code in the header names a type of the expected family, and
>>> stops parsing at the first failed check, including when MEOS is used as a
>>> library with an error handler that returns. We validated it with the
>>> PostgreSQL regression suite and with sanitizer-instrumented fuzzing of the
>>> binary input functions (several million malformed inputs per branch, with
>>> no memory error in the WKB readers).
>>>
>>> Affected versions: MobilityDB 1.1.x, 1.2.0, 1.2.1 and 1.3.0, and the
>>> development branch. We are publishing the fix today on the development
>>> branch and in patch releases of the 1.3 and 1.2 series, together with a
>>> GitHub security advisory. Please go ahead with the CVE record; could you
>>> send us the CVE ID so that we can add it to the advisory and the release
>>> notes? Please also let us know how the researcher would like to be credited.
>>>
>>> Best regards,
>>>
>>> Esteban
>>>
>>> ------------------------------------------------------------
>>> Prof. Esteban Zimanyi
>>> Department of Computer & Decision Engineering  (CoDE) CP 165/15
>>> Universite Libre de Bruxelles
>>> Avenue F. D. Roosevelt 50
>>> B-1050 Brussels, Belgium
>>> fax: + 32.2.650.47.13 <+32%202%20650%2047%2013>
>>> tel: + 32.2.650.31.85 <+32%202%20650%2031%2085>
>>> e-mail: esteban.zimanyi at ulb.be
>>> Internet: http://cs.ulb.ac.be/members/esteban/
>>> ------------------------------------------------------------
>>>
>>>
>>> On Mon, Sep 28, 2026 at 3:48 PM Brandon Tarr via Mobilitydb-dev <
>>> mobilitydb-dev at lists.osgeo.org> wrote:
>>>
>>>>
>>>> Greetings MobilityDB Security Team,
>>>>
>>>>
>>>> I'm a vulnerability analyst at VulnCheck <https://www.vulncheck.com/>
>>>> an exploit intelligence company and research CVE Numbering Authority (CNA),
>>>> where I'm one of several folks who manage our coordinated vulnerability
>>>> disclosure (CVD) program.
>>>>
>>>> An external security researcher recently reported
>>>> <https://www.vulncheck.com/advisories/report> a potential
>>>> vulnerability impacting [MobilityDB / MobilityDB
>>>> <https://github.com/MobilityDB/MobilityDB>] and VulnCheck is acting as
>>>> the intermediary and coordinator.
>>>>
>>>> VulnCheck follows a 120-day disclosure policy
>>>> <https://www.vulncheck.com/vulnerability-disclosure-policy>, meaning
>>>> we afford vendors/maintainers up to 120 days from the time of receiving the
>>>> report to address the issue before publication of a CVE record and
>>>> third-party advisory. For this vulnerability, the 120-day deadline is *January
>>>> 26, 2027 (26/01/2027)*. Of note, patch publication constitutes public
>>>> disclosure — if a patch is issued, we will publish the CVE record at that
>>>> time rather than waiting for the full 120-day window.
>>>>
>>>> The researcher has provided us with a comprehensive technical report,
>>>> which we have attached to this email. Let us know if you have any questions
>>>> for us about the CVD process or for the researcher regarding the reported
>>>> vulnerability.
>>>>
>>>> --
>>>> Thank you,
>>>>
>>>> <https://www.vulncheck.com/>
>>>>
>>>> Brandon Tarr
>>>> VulnCheck
>>>> _______________________________________________
>>>> Mobilitydb-dev mailing list
>>>> Mobilitydb-dev at lists.osgeo.org
>>>> https://lists.osgeo.org/mailman/listinfo/mobilitydb-dev
>>>>
>>>
>>
>> --
>> Thank you,
>>
>> <https://www.vulncheck.com/>
>>
>> Brandon Tarr
>> VulnCheck
>>
>

-- 
Thank you,

<https://www.vulncheck.com/>

Brandon Tarr
VulnCheck
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/mobilitydb-dev/attachments/20260929/1490e1cc/attachment-0001.htm>