CVE-2026-2005
Published: 12 February 2026
Summary
CVE-2026-2005 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Postgresql Postgresql. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-7 (Least Functionality).
Deeper analysis
CVE-2026-2005 is a heap buffer overflow vulnerability (CWE-122) in the pgcrypto extension of PostgreSQL, published on 2026-02-12. It affects versions prior to PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21. The issue arises when processing ciphertext, enabling a ciphertext provider to trigger the overflow and execute arbitrary code with the privileges of the operating system user running the database. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation with low privileges.
An attacker requires low privileges (PR:L), such as a database user with access to invoke pgcrypto functions, and can exploit this over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Successful exploitation allows arbitrary code execution as the OS user running PostgreSQL, potentially leading to full system compromise, data exfiltration, or further lateral movement depending on the database server's context and privileges.
Mitigation is addressed in the PostgreSQL security advisory at https://www.postgresql.org/support/security/CVE-2026-2005/, with fixes available in versions 18.2, 17.8, 16.12, 15.16, and 14.21. Security practitioners should prioritize upgrading affected installations and review access to pgcrypto functions to limit exposure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6182
Vulnerability details
Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in network-accessible PostgreSQL pgcrypto extension directly enables remote code execution by exploiting a server-side application vulnerability (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the heap buffer overflow in pgcrypto by requiring timely patching or upgrading to fixed PostgreSQL versions such as 18.2 or later.
Enforces least privilege by restricting database users' ability to execute pgcrypto functions, blocking low-privilege (PR:L) attackers from triggering the vulnerability.
Limits system functionality by disabling or restricting the pgcrypto extension when not required, preventing invocation of the vulnerable ciphertext processing code.