Executive brief
PostgreSQL is a widely used open-source database system. A security flaw in its statistics restoration function allows a database user with table maintenance privileges to read small amounts of server memory they should not have access to. While this does not allow for full system takeover, it could lead to the exposure of sensitive internal data or configuration details.
Technical details
A buffer over-read vulnerability (CWE-126) exists in the PostgreSQL function pg_restore_attribute_stats(). The function fails to properly validate that provided array values have matching lengths, leading the query planner to read past the end of an array during execution. An attacker with table maintenance privileges (PR:L) can exploit this over-read to infer memory values located adjacent to the array in the server's memory space. This issue specifically affects PostgreSQL version 18 prior to 18.4; versions prior to 18 are not impacted. Users should upgrade to PostgreSQL 18.4 to remediate the vulnerability.
Affected products
- PostgreSQL PostgreSQL 18.x before 18.4
Timeline
- 2026-05-12: patched: Fix published in version 18.4
- 2026-05-14: advisory: NVD and PostgreSQL security advisory published