What is CVE-2026-2003?

CVE-2026-2003 is a medium-severity vulnerability in Postgresql, classified under CWE-1287. CVSS score: 4.3/10. Published 2026-02-12.

How severe is CVE-2026-2003?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Postgresql

CVE-2026-2003

Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

EPSS: 0.003 (20.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Postgresql
N/a Postgresql — versions 18, 17, 16

Weakness classification (CWE)

CWE-1287

References

f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 (Vendor Advisory)

Frequently asked questions

What is CVE-2026-2003?: CVE-2026-2003 is a medium-severity vulnerability in Postgresql, classified under CWE-1287. CVSS score: 4.3/10. Published 2026-02-12.
How severe is CVE-2026-2003?: Medium severity. CVSS v3 base score is 4.3 out of 10.