Junglewise Threat Intelligence

CVE-2026-2007: PostgreSQL pg_trgm heap buffer overflow

CVE-2026-2007 · Severity: high · CVSS 8.2 · Published 2026-02-12

Technologies: Red Hat Enterprise Linux 10, PostgreSQL, Red Hat Enterprise Linux 9. Vendors: Red Hat, PostgreSQL.

Executive brief

A security vulnerability exists in the pg_trgm module of the PostgreSQL database, which is used for efficient searching of text data. An attacker can use a specially crafted text string to cause a memory error on the server. This could lead to service disruptions or potentially allow an attacker to gain higher-level permissions within the database system.

Technical details

A heap-based buffer overflow (CWE-122) exists in the pg_trgm contrib module of PostgreSQL. The vulnerability is triggered when processing a specifically crafted input string, allowing an attacker to write byte patterns onto server memory. While the attacker has limited control over the specific byte patterns written, the overflow could potentially be leveraged for privilege escalation or to cause a denial of service. The issue affects PostgreSQL versions 18.0 and 18.1 and has been addressed in version 18.2. Red Hat has also released updates for RHEL 9 and 10 to mitigate this issue.

Affected products

  • PostgreSQL PostgreSQL 18.0, 18.1
  • Red Hat Red Hat Enterprise Linux 9 9
  • Red Hat Red Hat Enterprise Linux 10 10.2

Timeline

  • 2026-02-12: disclosed
  • 2026-02-12: patched: Fixed in PostgreSQL 18.2
  • 2026-02-12: advisory
  • 2026-05-19: patched: Red Hat released RHSA-2026:19009

References

Related threats