Description

Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T13:17:48.740Z",
  "pubdate": "2026-08-13T13:17:48.740Z",
  "executiveSummary": "A heap buffer overflow vulnerability exists in the PostgreSQL utility pg_dump when processing excessively long function transform lists. This flaw allows a malicious object creator to execute arbitrary code with the privileges of the operating system user executing the pg_dump utility.\nThe vulnerability impacts PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24. The primary risk implication is complete system compromise of the database administrator or automated backup system running the dump operation, as successful exploitation yields arbitrary code execution within the host operating system context.\nAttacker capabilities require the ability to create or modify database objects—specifically, crafting a malicious transform list associated with a function within a PostgreSQL database. Exploitation is triggered when an administrative user or automated maintenance job executes pg_dump against the compromised or maliciously crafted database instance, causing the client-side application to parse the oversized transform list and corrupt heap memory structures during processing.",
  "technicalDetails": "The vulnerability resides in the heap-based buffer management logic of the PostgreSQL pg_dump utility when handling function transform lists. Specifically, the vulnerable component fails to properly validate or bound the size of transform list data retrieved from the server during database serialization, leading to a heap buffer overflow condition.\nThe root cause stems from insecure memory allocation and copying routines that do not adequately account for maliciously crafted or excessively long transform lists supplied via database metadata. When pg_dump parses these objects, the calculated size overflows the allocated heap buffer boundaries, resulting in heap corruption.\nThe attack flow proceeds as follows: First, an authenticated database user with object creation privileges crafts a malicious database schema containing a function with an abnormally long or specially structured transform list. Second, the victim (either a system administrator or an automated backup daemon) initiates a backup operation by running pg_dump against the target database or schema. Third, during the metadata extraction phase, pg_dump queries the system catalogs and reads the malicious transform list. Fourth, the oversized data is copied into an insufficiently sized heap buffer, overwriting adjacent heap memory structures. Finally, by carefully controlling the contents of the overflow, the attacker overwrites function pointers or critical control data on the heap, redirecting execution flow to arbitrary shellcode or a payload supplied within the payload data.\nAffected versions include all PostgreSQL installations prior to 18.5, 17.11, 16.15, 15.19, and 14.24. Authentication and privilege requirements for the initial vector require the attacker to have permissions to create database objects capable of defining transforms. However, no authentication or special privileges are required against the pg_dump utility itself; the client application executes with the local operating system privileges of the user invoking the backup. Network exposure depends on the deployment architecture, but the vector relies on the client connecting to a database instance under the attacker's control or populated with malicious data.\nPost-exploitation impact includes the execution of arbitrary operating system commands under the security context of the user running pg_dump. If automated backups are executed with elevated privileges (such as root or postgres service accounts), successful exploitation can lead to total host compromise, lateral movement within the network, and access to sensitive data across other databases managed by the same host."
}