Junglewise Threat Intelligence

CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow in contrib module

CVE-2026-2005 · Severity: high · CVSS 8.8 · Published 2026-02-12

Technologies: PostgreSQL, Red Hat Enterprise Linux. Vendors: PostgreSQL, Red Hat.

Executive brief

A vulnerability exists in the pgcrypto module of the PostgreSQL database, which provides cryptographic functions for data storage. An attacker with database access can trigger a memory error that allows them to execute malicious code directly on the server hosting the database. This could lead to a full system compromise, unauthorized data access, or a complete service disruption.

Technical details

A heap-based buffer overflow (CWE-122) exists in the pgcrypto 'contrib' module of PostgreSQL. The vulnerability is triggered when a ciphertext provider processes specially crafted input, leading to a buffer copy without checking the size of the input (CWE-120). An attacker with low-privileged database access can exploit this over a network to execute arbitrary code with the permissions of the 'postgres' operating system user. The issue is resolved in PostgreSQL versions 18.2, 17.8, 16.12, 15.16, and 14.21.

Affected products

  • PostgreSQL PostgreSQL < 18.2, < 17.8, < 16.12, < 15.16, < 14.21
  • Red Hat Red Hat Enterprise Linux 10

Timeline

  • 2026-02-12: disclosed
  • 2026-02-12: patched
  • 2026-02-12: advisory

References