Junglewise Threat Intelligence

CVE-2026-2004: PostgreSQL intarray remote code execution in selectivity estimator

CVE-2026-2004 · Severity: high · CVSS 8.8 · Published 2026-02-12

Technologies: PostgreSQL, Red Hat Enterprise Linux. Vendors: PostgreSQL, Red Hat.

Executive brief

A vulnerability exists in the 'intarray' extension of the PostgreSQL database, which is used for managing arrays of integers. An attacker with the ability to create database objects can exploit this flaw to execute unauthorized code on the server hosting the database. This could lead to a full system compromise, data theft, or service disruption, as the attacker would gain the same permissions as the database service itself.

Technical details

A vulnerability classified as Improper Validation of Specified Type of Input (CWE-1287) exists in the PostgreSQL 'intarray' contrib module. The root cause is a missing validation of input types within the selectivity estimator function. An attacker with 'object creator' permissions can leverage this lack of validation to trigger arbitrary code execution as the operating system user running the PostgreSQL service. The attack vector is over the network, requiring low-level authentication but no user interaction. Patches have been released in PostgreSQL versions 18.2, 17.8, 16.12, 15.16, and 14.21.

Affected products

  • PostgreSQL PostgreSQL < 18.2, < 17.8, < 16.12, < 15.16, < 14.21
  • Red Hat Red Hat Enterprise Linux 10

Timeline

  • 2026-02-12: disclosed
  • 2026-02-12: patched
  • 2026-02-12: advisory

References

Related threats