CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code
Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.21
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2004?
CVE-2026-2004 is considered to have a critical severity level due to the potential for arbitrary code execution.
How do I fix CVE-2026-2004?
To fix CVE-2026-2004, you should upgrade PostgreSQL to a version that is updated beyond the vulnerable releases, specifically version 18.3 or higher.
Which versions of PostgreSQL are affected by CVE-2026-2004?
CVE-2026-2004 affects PostgreSQL versions up to and including 18.2, 17.8, 16.12, 15.16, and 14.21.
What types of input are related to CVE-2026-2004?
CVE-2026-2004 involves missing validation of input types in the PostgreSQL intarray extension selectivity estimator function.
Who can exploit CVE-2026-2004?
An object creator or user with the ability to modify the intarray extension can exploit CVE-2026-2004 to execute arbitrary code.