4.3

CVE-2026-18024

PostgreSQL ascii() function reads past end of buffer

Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value.  This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact.  Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Postgresql ≫ Postgresql Version >= 14.0 < 14.24
Postgresql ≫ Postgresql Version >= 15.0 < 15.19
Postgresql ≫ Postgresql Version >= 16.0 < 16.15
Postgresql ≫ Postgresql Version >= 17.0 < 17.11
Postgresql ≫ Postgresql Version >= 18.0 < 18.5
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.3% 0.228
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-126 Buffer Over-read

The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

https://www.postgresql.org/support/security/CVE-2026-18024/
Vendor Advisory