Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
References
Configurations
Configuration 1 (hide)
|
History
30 Jun 2026, 03:18
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| CWE | CWE-1285 |
17 Jun 2026, 10:29
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
20 Feb 2026, 19:54
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* | |
| References | () https://www.postgresql.org/support/security/CVE-2026-2006/ - Vendor Advisory | |
| First Time |
Postgresql
Postgresql postgresql |
12 Feb 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-12 14:16
Updated : 2026-07-15 02:19
NVD link : CVE-2026-2006
Mitre link : CVE-2026-2006
CVE.ORG link : CVE-2026-2006
JSON object : View
Products Affected
postgresql
- postgresql
