CVE-2026-50735 is an out-of-bounds read vulnerability (CWE-125) in EnterpriseDB's pglogical replication system. The apply worker component does not properly validate the length of certain fields in incoming replication protocol messages before copying them, allowing a malicious publisher to cause the subscriber to read beyond allocated buffer boundaries. This can lead to disclosure of adjacent process memory or cause the apply worker to crash. Exploitation requires the attacker to control the publisher endpoint of a subscription, which typically requires superuser privileges, limiting the attack surface primarily to managed deployments with delegated subscription creation.

Successful exploitation can result in disclosure of adjacent process memory or denial of service by crashing the apply worker process. The vulnerability requires the attacker to control the publisher endpoint of a pglogical subscription. In default configurations, this requires superuser privileges, so the risk is higher in managed environments where non-superuser roles can create subscriptions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the ability to create subscriptions to trusted superusers only, and avoid directing subscriptions to untrusted or external endpoints. Monitor vendor communications for official patches or mitigations.