CVE-2026-2006: PostgreSQL missing validation of multibyte character length executes arbitrary code

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-12 · updated 2026-07-15
Weakness: CWE-129

Description

Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

Affected products

PostgreSQL: from 14.0 before 14.21; from 15.0 before 15.16; from 16.0 before 16.12; from 17.0 before 17.8; from 18.0 before 18.2 — fixed in 14.21, 15.16, 16.12, 17.8, 18.2

How to fix

Upgrade to a fixed version: PostgreSQL 14.21, 15.16, 16.12, 17.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-2006 or the next vulnerability affects your stack