CVE-2026-33815 is a memory-safety vulnerability classified under CWE-129 (Improper Validation of Array Index) and CWE-787 (Out-of-bounds Write) in the github.com/jackc/pgx/v5/pgproto3 package. This flaw allows write operations beyond the intended memory bounds, potentially leading to memory corruption, modification of control data such as return addresses, unauthorized code execution, denial of service via crashes or restarts, and undefined or unexpected program states. The vulnerability is remotely exploitable over the network without user interaction or privileges. Red Hat's advisory notes the absence of an effective mitigation or fix that meets their deployment and stability standards at this time. The CVSS v3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting critical severity.

Successful exploitation of this vulnerability can lead to complete compromise of confidentiality, integrity, and availability of affected systems. Memory corruption may allow attackers to execute arbitrary code, cause system crashes, or induce unexpected application behavior. The vulnerability is exploitable remotely without authentication or user interaction, increasing its risk. However, no known exploits are reported in the wild at this time.

Currently, no official fix or mitigation meeting Red Hat's criteria for ease of use, applicability, or stability is available. Users should monitor Red Hat and upstream advisories for future patches or mitigations. Until a fix is released, consider limiting exposure of affected components to untrusted networks and applying defense-in-depth controls where feasible. Customers with Red Hat Technical Account Managers can seek direct guidance. Avoid relying on unverified third-party patches.