Description

Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-13T13:17:47.880Z",
  "pubdate": "2026-08-13T13:17:47.880Z",
  "executiveSummary": "A buffer over-read vulnerability exists in the ascii() SQL function within PostgreSQL. The flaw allows an authenticated user to disclose up to 3 bytes of memory residing immediately beyond the boundary of a specific heap allocation by supplying a specially crafted text value. This defect represents a variant of the memory disclosure issue previously addressed by CVE-2026-2006, though it exhibits a more limited operational impact due to the restricted scope of the data read.\nAffected products include PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24. The risk implications involve potential unauthorized information disclosure of adjacent memory structures, which may expose sensitive database internal states or transient data. Exploitation requires the ability to execute arbitrary SQL queries against the database engine, meaning an attacker must possess database access privileges capable of invoking the vulnerable ascii() function.",
  "technicalDetails": "The vulnerability resides in the internal C implementation of the PostgreSQL ascii() SQL function, specifically within string parsing routines that handle text input arguments. The root cause stems from an incorrect bounds check or improper length calculation when evaluating the provided text value, leading to a read operation that extends beyond the allocated memory buffer by up to 3 bytes.\nThe vulnerable component is the ascii() function handling string inputs within the PostgreSQL core database engine. Exploitation occurs when an authenticated database user crafts a specific text input string designed to trigger the miscalculated boundary read within the function's execution context. As the function processes the malformed input, it reads past the termination of the target allocation buffer. Depending on the memory layout and allocator behavior, the trailing bytes read from adjacent memory are subsequently processed or indirectly reflected back through the function's execution or error handling, thereby leaking residual memory contents.\nThe attack flow requires the adversary to establish an active session with the PostgreSQL database server and successfully execute a SQL query invoking the vulnerable ascii() function with the crafted text payload. Authentication and execution privileges capable of running standard SQL functions are required, as unauthenticated attackers cannot directly invoke SQL scalar functions. The network exposure is constrained by the database listener's accessibility, typically TCP port 5432 or local Unix domain sockets. Post-exploitation impact is strictly limited to the unauthorized disclosure of up to 3 bytes of adjacent heap memory per vulnerable function invocation, preventing arbitrary code execution or full system compromise from this vector alone."
}