CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code
Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQL pgcryptoto a version that resolves this vulnerability.Fixed in 18.2 - Upgrade
Upgrade
PostgreSQL pgcryptoto a version that resolves this vulnerability.Fixed in 17.8 - Upgrade
Upgrade
PostgreSQL pgcryptoto a version that resolves this vulnerability.Fixed in 16.12 - Upgrade
Upgrade
PostgreSQL pgcryptoto a version that resolves this vulnerability.Fixed in 15.16 - Upgrade
Upgrade
PostgreSQL pgcryptoto a version that resolves this vulnerability.Fixed in 14.21
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2005?
CVE-2026-2005 has a critical severity due to the potential for arbitrary code execution.
How do I fix CVE-2026-2005?
To fix CVE-2026-2005, upgrade to PostgreSQL version 18.2 or 17.8 or newer versions of 16.x, 15.x, and 14.x.
What versions of PostgreSQL are affected by CVE-2026-2005?
CVE-2026-2005 affects PostgreSQL versions earlier than 18.2, 17.8, 16.12, 15.16, and 14.21.
What type of vulnerability is CVE-2026-2005?
CVE-2026-2005 is a heap buffer overflow vulnerability in the pgcrypto module of PostgreSQL.
Who can be affected by CVE-2026-2005?
Database users running affected versions of PostgreSQL could be exploited by a malicious ciphertext provider to execute arbitrary code.