Mostly not, and the hill is the reason. Only a sliver of the town sits in the river flood zones. Rain running off the streets reaches further than the rivers do. The risk follows the two rivers that wrap around the foot of the hill. Up top is one question, down by the water is a different one.
The Environment Agency's river-and-sea flood zones cover a small share of the area's postcodes: about 1% in Zone 3, the highest-probability band, and about 3% in Zone 2, the medium-probability fringe beyond it. The two bands don't overlap, which is why the outer zone can be the bigger number without contradicting anything. The old town sits on a hilltop almost surrounded by the Bristol Avon and the Tetbury Avon, known locally as the Ingleburn, and those rivers have shaped events before. In the winter of 1153, Stephen and Henry of Anjou faced each other across a River Avon too high to cross, and the succession was settled without a battle. The river is still the thing to check.
Surface water is the part buyers underestimate. No separate surface-water figure exists for this area, but it is folded into the postcode-level measure below, and it explains why that measure runs well ahead of the river zones. The Environment Agency has 24 recorded flood events for the area, the most recent from the main river in November 2012, and about 6% of postcodes fall within a recorded historic flood outline. A house that has never flooded has not necessarily never been close.
Looking ahead, about 7% of postcodes fall inside the flood zone once the Environment Agency's climate-change allowance is applied. That isn't a forecast of flooding. It is the planners' mapping of where the zone may reach as rainfall and river flows change, and it is the number a lender or insurer thinking twenty-five years ahead will care about.
On insurance, a property inside the river flood zones or with a flood history should expect questions and a higher premium, and some insurers will want a detailed survey before quoting. Get an indicative quote on the exact address before paying for a solicitor. Finding out at exchange is the expensive way.
At postcode level, and counting any single measure including surface water, about 14% of postcodes rate high on at least one indicator, 13% medium and 33% low. Those bands overlap with the zone figures above and measure a different thing, so they should not be added together or read as the same risk. The listing that says "not in a flood zone" is telling the truth about one measure and nothing about the others.
Counting homes is more useful than counting postcodes. The Environment Agency's rivers-and-sea mapping lists 27 postcodes carrying some risk, with 620 properties inside them. Of those, 27 properties are at high risk, 16 of them residential, 12 at medium risk and 75 at low risk. Postcodes with no river or sea risk don't appear in that list at all, so the 620 is the exposed edge of the town, not the whole of it.
Defences barely change the numbers. About 1% of postcodes sit in the high-risk extent with no defence modelled, and about 1% sit in it with one. "Defended" here means a defence exists in the model. It does not mean the water stays out, and no buyer should take it as reassurance without seeing what the defence is and who maintains it.
The nearest tide gauge, at Portsmouth, recorded sea level rising by about 2 millimetres a year over its record from 1962 to 2023. That is a measured historic rate at a port a long way from here, and it matters to an inland hilltop town mainly as a reminder that generic flood reports include the sea whether it applies or not.
For most of Malmesbury the flood risk is modest, and for the streets near the rivers it's real. Call it middling overall: fine on the hill, and a proper check before you buy anywhere near the water.