CVE-2026-6665

High

Published: 09 May 2026

Published

09 May 2026

Modified

14 May 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0037 29.1th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-6665 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Pgbouncer Pgbouncer. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 29.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-28877

Vulnerability details

The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack…

overflow.

CWE(s): CWE-121

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

Why these techniques?

Stack overflow in PgBouncer client-side SCRAM handling triggered by malicious backend response directly enables remote code execution via client exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0