Vulnerability in Postgresql
CVE-2026-2006
Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running t…
EPSS: 0.011 (60.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Postgresql
- N/a Postgresql — versions 18, 17, 16
Weakness classification (CWE)
References
- f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 (Vendor Advisory)
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Frequently asked questions
- What is CVE-2026-2006?
- CVE-2026-2006 is a high-severity vulnerability in Postgresql, classified under Improper Validation of Array Index. CVSS score: 8.8/10. Published 2026-02-12.
- How severe is CVE-2026-2006?
- High severity. CVSS v3 base score is 8.8 out of 10.