Buffer overflow vulnerability in the PostgreSQL pgcrypto module
A vulnerability affecting PostgreSQL would allow an authenticated attacker to cause memory corruption and potentially execute arbitrary code on affected systems.
Description
Technical context and vulnerability details
PostgreSQL is a widely deployed open source relational database management system; its pgcrypto module provides encryption functions within the database. This product is affected by a CVE-2026-2005 vulnerability resulting from a heap buffer overflow within the pgp_parse_pubenc_sesskey function of the pgcrypto module, when processing ciphertext controlled by a malicious actor. Exploitation of this vulnerability would allow an authenticated attacker with the ability to execute SQL queries to cause memory corruption and execute arbitrary code with the privileges of the system account running the database. It is classified critical with a severity score of 8.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Compromise of system integrity;
- Data privacy breach;
- Breach of data availability;
- Memory corruption;
Affected systems
Products, components and targeted versions
- PostgreSQL versions prior to 18.2, 17.8, 16.12, 15.16 and 14.21;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update PostgreSQL to one of patched versions 18.2, 17.8, 16.12, 15.16 or 14.21, or later;
- Restrict database access and SQL query execution to trusted accounts only;
- Apply the principle of least privilege to database accounts;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.