PostgreSQL ascii() function reads past end of buffer (CVE-2026-18024)
A buffer over-read vulnerability exists in the PostgreSQL ascii() SQL function that allows disclosure of up to 3 bytes beyond the allocated buffer when processing a crafted text value. This vulnerability affects multiple PostgreSQL versions prior to 14.24, 15.19, 16.15, 17.11, and 18.6. The issue is similar to a previously fixed defect (CVE-2026-2006) but with less impact. A patch is available to address this vulnerability.
AI Analysis
Technical Summary
CVE-2026-18024 is a buffer over-read vulnerability in the ascii() function of PostgreSQL. It allows a user to read up to 3 bytes beyond the end of a specific memory allocation by supplying a specially crafted text input. This vulnerability is a variant of a previously fixed issue (CVE-2026-2006) but with reduced impact. Affected versions include all PostgreSQL releases before 14.24, 15.19, 16.15, 17.11, and 18.6. The vulnerability is categorized under CWE-126 (Buffer Over-read).
Potential Impact
An attacker can potentially disclose up to 3 bytes of memory beyond the intended buffer boundary when invoking the ascii() function with crafted input. While this may lead to limited information disclosure, the impact is considered moderate due to the small amount of data exposed and the specific conditions required.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade PostgreSQL to versions 14.24, 15.19, 16.15, 17.11, 18.6 or later to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.
PostgreSQL ascii() function reads past end of buffer (CVE-2026-18024)
Description
A buffer over-read vulnerability exists in the PostgreSQL ascii() SQL function that allows disclosure of up to 3 bytes beyond the allocated buffer when processing a crafted text value. This vulnerability affects multiple PostgreSQL versions prior to 14.24, 15.19, 16.15, 17.11, and 18.6. The issue is similar to a previously fixed defect (CVE-2026-2006) but with less impact. A patch is available to address this vulnerability.
Affected software
pkg:deb/postgresql/postgresqlRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-18024 is a buffer over-read vulnerability in the ascii() function of PostgreSQL. It allows a user to read up to 3 bytes beyond the end of a specific memory allocation by supplying a specially crafted text input. This vulnerability is a variant of a previously fixed issue (CVE-2026-2006) but with reduced impact. Affected versions include all PostgreSQL releases before 14.24, 15.19, 16.15, 17.11, and 18.6. The vulnerability is categorized under CWE-126 (Buffer Over-read).
Potential Impact
An attacker can potentially disclose up to 3 bytes of memory beyond the intended buffer boundary when invoking the ascii() function with crafted input. While this may lead to limited information disclosure, the impact is considered moderate due to the small amount of data exposed and the specific conditions required.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade PostgreSQL to versions 14.24, 15.19, 16.15, 17.11, 18.6 or later to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-mpm7-fx5w-5w53
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-18024"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a7e0366bf8831d5398f855b
Added to database: 08/13/2026, 17:48:22 UTC
Last enriched: 09/08/2026, 15:14:13 UTC
Last updated: 09/28/2026, 13:47:42 UTC
Views: 46
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.