CVE-2026-18024
Received Received - Intake

Buffer Over-Read in PostgreSQL ascii() SQL Function

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: PostgreSQL

Description
Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-18024
EUVD
EUVD-2026-57851

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
postgresql postgresql to 18.5 (exc)
postgresql postgresql to 17.11 (exc)
postgresql postgresql to 16.15 (exc)
postgresql postgresql to 15.19 (exc)
postgresql postgresql to 14.24 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-126 The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a buffer over-read in PostgreSQL's ascii() SQL function. It allows a user to read up to 3 bytes of memory beyond the intended allocation by providing a specially crafted text value. The issue affects PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, and 14.24.

Detection Guidance

To detect this vulnerability, check your PostgreSQL version using 'psql --version' or 'SELECT version();'. If your version is below 18.5, 17.11, 16.15, 15.19, or 14.24, your system is affected. Review logs for unusual ascii() function usage or memory disclosure patterns.

Impact Analysis

An attacker could exploit this to disclose sensitive memory contents, potentially revealing confidential data. However, the impact is limited as only up to 3 bytes can be read and the vulnerability requires user privileges.

Compliance Impact

This vulnerability could lead to unauthorized data disclosure, which may violate GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations must patch to maintain compliance.

Mitigation Strategies

Upgrade PostgreSQL to version 18.5, 17.11, 16.15, 15.19, or 14.24 or later immediately. Apply the latest security patches from PostgreSQL's official site. Restrict database access to trusted users until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18024. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart