CVE-2026-2005
Undergoing Analysis
Undergoing Analysis - In Progress
Heap Buffer Overflow in PostgreSQL pgcrypto Enables Code Execution
Publication date: 2026-02-12
Last updated on: 2026-02-20
Assigner: PostgreSQL
Description
Description
Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| postgresql | postgresql | From 18.0 (inc) to 18.2 (exc) |
| postgresql | postgresql | From 14.0 (inc) to 14.21 (exc) |
| postgresql | postgresql | From 15.0 (inc) to 15.16 (exc) |
| postgresql | postgresql | From 16.0 (inc) to 16.12 (exc) |
| postgresql | postgresql | From 17.0 (inc) to 17.8 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
