Description

A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a specially crafted malformed TDS prelogin packet to the TDS port. This record consolidates a related NULL-pointer-dereference finding in the same prelogin parser. To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-06T19:17:39.360Z",
  "pubdate": "2026-11-06T19:17:39.360Z",
  "executiveSummary": "A critical heap-based buffer overflow vulnerability exists within the Tabular Data Stream (TDS) prelogin parser of the Babelfish for PostgreSQL extension. This security flaw, which also encompasses a related NULL-pointer-dereference issue, exposes affected systems to potential remote code execution.\nThe vulnerability resides in how the TDS protocol implementation handles initial connection handshake packets. By transmitting a specifically crafted, malformed prelogin packet to the TDS port (default 1433), an unauthenticated remote attacker can trigger memory corruption within the database process space.\nSuccessful exploitation allows an adversary to execute arbitrary OS commands with the privileges of the database service user, posing a severe risk to data integrity, confidentiality, and overall system availability. The vulnerability affects multiple versions across the 1.x, 2.x, 3.x, 4.x, and 5.x branches of Babelfish for PostgreSQL, as well as specific Amazon Aurora PostgreSQL deployments.\nGiven the ability to achieve remote command execution without prior authentication, this vulnerability is categorized as high-severity. Immediate remediation through version upgrades is required, supplemented by network-level access controls to restrict exposure of the TDS interface.",
  "technicalDetails": "The vulnerability is localized within the TDS prelogin parser, which is responsible for processing the initial negotiation phase of the Tabular Data Stream protocol before authentication occurs. The root cause is an improper memory management implementation during the parsing of malformed TDS prelogin packets, leading to a heap-based buffer overflow.\nThe attack flow initiates when an attacker sends a malicious payload encapsulated within a TDS prelogin packet to the configured TDS port (typically TCP 1433). Because this parsing logic executes prior to the completion of the authentication handshake, the attacker does not require valid database credentials to trigger the vulnerability. The parsing function fails to correctly validate the length or structure of the incoming packet metadata, allowing an attacker to write data beyond the bounds of the allocated heap buffer.\nThis overflow allows an attacker to overwrite adjacent memory structures, such as object pointers or function pointers, potentially redirecting execution flow. By carefully crafting the malicious payload, an attacker can gain control over the instruction pointer, leading to the execution of arbitrary OS-level commands under the context of the PostgreSQL process user. The consolidation of this finding with a NULL-pointer-dereference suggests broader instability in the prelogin parser's state machine, where improper error handling during packet processing could lead to a denial-of-service condition or facilitate reliable exploitation of the overflow.\nThe scope of affected software is broad, covering Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, and 5.1-5.4. Amazon Aurora PostgreSQL instances utilizing these versions are also impacted. The impact of successful exploitation is significant; as the code executes with the privileges of the database process, the attacker may bypass internal database security controls, exfiltrate sensitive data, or establish persistence on the underlying host OS. Post-exploitation activities depend on the attacker's objectives but typically involve the escalation of access within the environment, lateral movement, or the deployment of additional malicious payloads."
}