CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-12 · updated 2026-07-15
Weakness: CWE-122

Description

Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

Affected products

PostgreSQL: from 14.0 before 14.21; from 15.0 before 15.16; from 16.0 before 16.12; from 17.0 before 17.8; from 18.0 before 18.2 — fixed in 14.21, 15.16, 16.12, 17.8, 18.2

How to fix

Upgrade to a fixed version: PostgreSQL 14.21, 15.16, 16.12, 17.8. Check the vendor advisory for mitigations.

References

https://www.postgresql.org/support/security/CVE-2026-2005/
https://access.redhat.com/errata/RHSA-2026:19009
https://access.redhat.com/errata/RHSA-2026:19010
https://access.redhat.com/errata/RHSA-2026:3730
https://access.redhat.com/errata/RHSA-2026:3887
https://access.redhat.com/errata/RHSA-2026:3896
https://access.redhat.com/errata/RHSA-2026:4024
https://access.redhat.com/errata/RHSA-2026:4059
https://access.redhat.com/errata/RHSA-2026:4063
https://access.redhat.com/errata/RHSA-2026:4064
https://access.redhat.com/errata/RHSA-2026:4074
https://access.redhat.com/errata/RHSA-2026:4075

Get alerted when CVE-2026-2005 or the next vulnerability affects your stack