vulnerability
PostgreSQL: CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 9 | (AV:N/AC:L/Au:S/C:C/I:C/A:C) | Feb 13, 2026 | Feb 13, 2026 | Mar 27, 2026 |
Severity
9
CVSS
(AV:N/AC:L/Au:S/C:C/I:C/A:C)
Published
Feb 13, 2026
Added
Feb 13, 2026
Modified
Mar 27, 2026
Description
Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
Solutions
postgres-upgrade-14_21postgres-upgrade-15_16postgres-upgrade-16_12postgres-upgrade-17_8postgres-upgrade-18_2
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.