# CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow in contrib module

Source: https://junglewise.ai/threats/cve-2026-2005-postgresql-pgcrypto-heap-buffer-overflow-in-contrib-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-12. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-2005 · Severity: high · CVSS 8.8 · Published 2026-02-12

A vulnerability exists in the pgcrypto module of the PostgreSQL database, which provides cryptographic functions for data storage. An attacker with database access can trigger a memory error that allows them to execute malicious code directly on the server hosting the database. This could lead to a full system compromise, unauthorized data access, or a complete service disruption.

## Quick answers

**Is CVE-2026-2005 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2005 being exploited in the wild.

**How severe is CVE-2026-2005?** High severity, with a CVSS score of 8.8, published 12 February 2026.

**Which products and versions are affected?** PostgreSQL PostgreSQL < 18.2, < 17.8, < 16.12, < 15.16, < 14.21; Red Hat Red Hat Enterprise Linux 10.

**Is there a fix for CVE-2026-2005?** A patch was published on 2026-02-12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2005 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-2005?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow (CWE-122) exists in the pgcrypto 'contrib' module of PostgreSQL. The vulnerability is triggered when a ciphertext provider processes specially crafted input, leading to a buffer copy without checking the size of the input (CWE-120). An attacker with low-privileged database access can exploit this over a network to execute arbitrary code with the permissions of the 'postgres' operating system user. The issue is resolved in PostgreSQL versions 18.2, 17.8, 16.12, 15.16, and 14.21.

## Affected products

- PostgreSQL PostgreSQL < 18.2, < 17.8, < 16.12, < 15.16, < 14.21
- Red Hat Red Hat Enterprise Linux 10

## Timeline

- 2026-02-12: disclosed
- 2026-02-12: patched
- 2026-02-12: advisory

## References

- [https://www.postgresql.org/support/security/CVE-2026-2005/](https://www.postgresql.org/support/security/CVE-2026-2005/)
- [https://access.redhat.com/errata/RHSA-2026:19009](https://access.redhat.com/errata/RHSA-2026:19009)
- [https://access.redhat.com/errata/RHSA-2026:19010](https://access.redhat.com/errata/RHSA-2026:19010)
- [https://access.redhat.com/errata/RHSA-2026:3730](https://access.redhat.com/errata/RHSA-2026:3730)
- [https://access.redhat.com/errata/RHSA-2026:3887](https://access.redhat.com/errata/RHSA-2026:3887)
- [https://access.redhat.com/errata/RHSA-2026:3896](https://access.redhat.com/errata/RHSA-2026:3896)
- [https://access.redhat.com/errata/RHSA-2026:4024](https://access.redhat.com/errata/RHSA-2026:4024)