CVE-2026-2005

High

Published: 12 February 2026

Published

12 February 2026

Modified

20 February 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0003 10.1th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2005 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Postgresql Postgresql. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-7 (Least Functionality).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the heap buffer overflow in pgcrypto by requiring timely patching or upgrading to fixed PostgreSQL versions such as 18.2 or later.

AC-6 Least Privilege good match

prevent

Enforces least privilege by restricting database users' ability to execute pgcrypto functions, blocking low-privilege (PR:L) attackers from triggering the vulnerability.

CM-7 Least Functionality good match

prevent

Limits system functionality by disabling or restricting the pgcrypto extension when not required, preventing invocation of the vulnerable ciphertext processing code.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Heap buffer overflow in network-accessible PostgreSQL pgcrypto extension directly enables remote code execution by exploiting a server-side application vulnerability (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

Deeper analysisAI

CVE-2026-2005 is a heap buffer overflow vulnerability (CWE-122) in the pgcrypto extension of PostgreSQL, published on 2026-02-12. It affects versions prior to PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21. The issue arises when processing ciphertext, enabling a ciphertext provider to trigger the overflow and execute arbitrary code with the privileges of the operating system user running the database. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation with low privileges.

An attacker requires low privileges (PR:L), such as a database user with access to invoke pgcrypto functions, and can exploit this over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Successful exploitation allows arbitrary code execution as the OS user running PostgreSQL, potentially leading to full system compromise, data exfiltration, or further lateral movement depending on the database server's context and privileges.

Mitigation is addressed in the PostgreSQL security advisory at https://www.postgresql.org/support/security/CVE-2026-2005/, with fixes available in versions 18.2, 17.8, 16.12, 15.16, and 14.21. Security practitioners should prioritize upgrading affected installations and review access to pgcrypto functions to limit exposure.