8.8
CVE-2026-2006
- EPSS 1.08%
- Veröffentlicht 12.02.2026 13:00:10
- Zuletzt bearbeitet 30.06.2026 03:18:10
- Quelle f86ef6dc-4d3a-42ad-8f28-e6d554
- CVE-Watchlists
- Unerledigt
PostgreSQL missing validation of multibyte character length executes arbitrary code
Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Postgresql ≫ Postgresql Version >= 14.0 < 14.21
Postgresql ≫ Postgresql Version >= 15.0 < 15.16
Postgresql ≫ Postgresql Version >= 16.0 < 16.12
Postgresql ≫ Postgresql Version >= 17.0 < 17.8
Postgresql ≫ Postgresql Version >= 18.0 < 18.2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.08% | 0.609 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input
The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.
CWE-129 Improper Validation of Array Index
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
https://www.postgresql.org/support/security/CVE-2026-2006/
https://access.redhat.com/errata/RHSA-2026:4943
https://access.redhat.com/errata/RHSA-2026:19009
https://access.redhat.com/errata/RHSA-2026:19010
https://access.redhat.com/errata/RHSA-2026:3730
https://access.redhat.com/errata/RHSA-2026:3887
https://access.redhat.com/errata/RHSA-2026:3896
https://access.redhat.com/errata/RHSA-2026:4024
https://access.redhat.com/errata/RHSA-2026:4059
https://access.redhat.com/errata/RHSA-2026:4063
https://access.redhat.com/errata/RHSA-2026:4064
https://access.redhat.com/errata/RHSA-2026:4074
https://access.redhat.com/errata/RHSA-2026:4075
https://access.redhat.com/errata/RHSA-2026:4110
https://access.redhat.com/errata/RHSA-2026:4254
https://access.redhat.com/errata/RHSA-2026:4441
https://access.redhat.com/errata/RHSA-2026:4475
https://access.redhat.com/errata/RHSA-2026:4504
https://access.redhat.com/errata/RHSA-2026:4505
https://access.redhat.com/errata/RHSA-2026:4506
https://access.redhat.com/errata/RHSA-2026:4509
https://access.redhat.com/errata/RHSA-2026:4515
https://access.redhat.com/errata/RHSA-2026:4516
https://access.redhat.com/errata/RHSA-2026:4518
https://access.redhat.com/errata/RHSA-2026:4524
https://access.redhat.com/errata/RHSA-2026:4528
https://access.redhat.com/errata/RHSA-2026:4544
https://access.redhat.com/errata/RHSA-2026:4546
https://access.redhat.com/errata/RHSA-2026:4547
https://access.redhat.com/errata/RHSA-2026:4548
https://access.redhat.com/errata/RHSA-2026:8756
https://access.redhat.com/security/cve/CVE-2026-2006
https://bugzilla.redhat.com/show_bug.cgi?id=2439324
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2006.json