Description

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T13:17:43.847Z",
  "pubdate": "2026-08-13T13:17:43.847Z",
  "executiveSummary": "A heap buffer overflow vulnerability exists within the regular expression handling component of PostgreSQL. This security flaw enables a malicious query author to execute arbitrary operating system code under the privileges of the database user running the PostgreSQL service.\nThe vulnerability is triggered by supplying specifically crafted text inputs designed to bypass standard encoding validation checks. This shares operational heritage with CVE-2026-2006, specifically manifesting through unanticipated data growth conditions when text strings are round-tripped through pg_wchar conversion mechanisms.\nAffected products include multiple versions of PostgreSQL prior to the security maintenance releases 18.5, 17.11, 16.15, 15.19, and 14.24. The risk implications are severe, as successful exploitation results in complete system compromise at the database OS user privilege level.\nAttackers require the capability to author and execute database queries, meaning standard database access with query execution privileges is the primary prerequisite for launching an exploit.",
  "technicalDetails": "The root cause of the vulnerability resides in the memory management logic of the PostgreSQL regular expression (regexp) engine, specifically interacting with the pg_wchar character conversion routines. When text data is processed and round-tripped through pg_wchar, certain sequences lead to an unanticipated expansion in data size that was not accurately accounted for during memory allocation bounds calculations.\nThe vulnerable component is the internal regexp processing subsystem. Because the input text is crafted to bypass initial encoding validation checks, it is ingested into the processing pipeline where memory buffers are allocated based on pre-expansion size estimates rather than the final post-conversion dimensions.\nDuring the execution of the regular expression evaluation, the unexpectedly large data volume overflows the boundaries of the dynamically allocated heap buffer, corrupting adjacent heap memory structures. An attacker can carefully orchestrate this heap corruption to overwrite critical control data structures or function pointers.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious query containing specially formatted text that circumvents encoding validation. Second, the query is submitted to the PostgreSQL database engine for execution. Third, the regexp engine processes the input, triggering the pg_wchar round-trip data growth anomaly. Fourth, the oversized data spills past the allocated heap buffer boundaries, inducing a heap buffer overflow. Finally, the attacker leverages the memory corruption to inject and execute arbitrary shell or system code.\nAffected versions comprise PostgreSQL prior to 18.5, 17.11, 16.15, 15.19, and 14.24. Exploitation requires the ability to connect to the database and author or execute queries, though no specialized high-level administrative privileges are inherently required if low-privileged users can execute vulnerable regexp functions against malicious payloads.\nThe post-exploitation impact grants the attacker code execution capabilities equivalent to the operating system user running the database daemon, potentially allowing lateral movement, data exfiltration, or complete host takeover."
}