CVE-2026-102639: MobilityDB WKB Deserialization DoS Vulnerability

CVE-2026-102639 Overview

CVE-2026-102639 is an out-of-bounds read vulnerability in MobilityDB version 1.3.0 and earlier. The flaw exists in the Mobility Engine Open Source (MEOS) binary and library Well-Known Binary (WKB) deserialization logic. An unprivileged database user can crash the PostgreSQL backend by sending a crafted WKB payload with a negative length field. The resulting denial-of-service affects every session on the PostgreSQL instance. The issue is tracked as CWE-195: Signed to Unsigned Conversion Error.

Critical Impact
Any authenticated PostgreSQL user can remotely crash the database backend by supplying a malformed WKB payload, disrupting all sessions on the instance.

Affected Products

MobilityDB 1.3.0 and earlier
MobilityDB 1.2.x versions prior to 1.2.2
MEOS library and binary bundled with affected MobilityDB releases

Discovery Timeline

2026-09-29 - CVE-2026-102639 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-102639

Vulnerability Analysis

MobilityDB extends PostgreSQL and PostGIS with support for temporal and spatiotemporal data. The MEOS component parses WKB payloads to reconstruct geometry and temporal objects. The deserialization routine reads a length field from attacker-controlled input and passes it to downstream size checks and memory operations. Because the length is stored as a signed integer but later interpreted as an unsigned size_t, a negative value wraps to a very large positive size. This corrupted length propagates into memcpy() inside text_from_wkb_state(), triggering an out-of-bounds read that crashes the PostgreSQL backend process.

Root Cause

The function wkb_parse_state_check() performs pointer arithmetic to validate that the requested read remains within buffer bounds. The check does not verify that the incoming length is non-negative before casting. When a negative value is converted to size_t, the wraparound produces a value larger than the buffer, but the bounds check itself is overflow-unsafe and fails to reject the value. Control then reaches text_from_wkb_state(), which invokes memcpy() with the attacker-influenced length and reads outside the allocated buffer.

Attack Vector

An attacker requires only low-privileged authenticated access to a PostgreSQL instance running MobilityDB. The attacker submits a SQL statement that invokes a MobilityDB function accepting WKB input, embedding a crafted payload with a negative length field. The malformed input triggers the out-of-bounds read and terminates the backend process. Because PostgreSQL treats a backend crash as a potential shared-memory corruption event, the postmaster resets all active connections. This produces a denial-of-service condition affecting every session on the instance.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-2c92-2w7c-pm3g and the VulnCheck Out-of-Bounds Read Advisory for additional technical detail.

Detection Methods for CVE-2026-102639

Indicators of Compromise

Unexpected PostgreSQL backend termination messages in postgresql.log referencing signal 11 (SIGSEGV) during WKB parsing
Log entries showing server process was terminated followed by terminating any other active server processes
Repeated SQL calls to MobilityDB WKB input functions from a single low-privilege role prior to the crash

Detection Strategies

Enable PostgreSQL log_min_messages = warning and log_statement = 'all' on MobilityDB-enabled instances to capture the queries preceding backend crashes
Correlate PostgreSQL crash events with database session identity to attribute malformed WKB submissions to specific roles
Inventory MobilityDB installations and flag any instance running versions at or below 1.3.0 in the 1.3.x branch or below 1.2.2 in the 1.2.x branch

Monitoring Recommendations

Alert on PostgreSQL postmaster resets and connection storms following segmentation faults in MobilityDB extension code
Monitor for repeated invocations of MobilityDB functions that accept WKB input from non-administrative roles
Track the health of MobilityDB-dependent applications for service disruption patterns consistent with database restarts

How to Mitigate CVE-2026-102639

Immediate Actions Required

Upgrade MobilityDB to version 1.3.1 or 1.2.2, which contain the fix for the signed length validation flaw
Restart affected PostgreSQL instances after upgrading the extension to load the patched shared library
Restrict EXECUTE privileges on MobilityDB functions that accept WKB input to trusted roles until patching is complete

Patch Information

The MobilityDB maintainers released fixes in MobilityDB v1.3.1 and MobilityDB v1.2.2. Both releases add signed validation of the WKB length field before it is cast to size_t, preventing the wraparound that bypasses the bounds check in wkb_parse_state_check(). Refer to GitHub Security Advisory GHSA-2c92-2w7c-pm3g for the coordinated advisory.

Workarounds

Revoke database access from untrusted or low-privilege accounts on MobilityDB-enabled instances until the extension is upgraded
Place MobilityDB-backed applications behind a query proxy that rejects or sanitizes WKB inputs originating from external users
Isolate MobilityDB workloads on dedicated PostgreSQL clusters so that a backend crash does not disrupt unrelated application databases

bash

# Verify installed MobilityDB extension version and upgrade
psql -c "SELECT extname, extversion FROM pg_extension WHERE extname = 'mobilitydb';"
psql -c "ALTER EXTENSION mobilitydb UPDATE TO '1.3.1';"