The vulnerability CVE-2026-2004 in PostgreSQL arises from improper validation of the type of input in the intarray extension's selectivity estimator function. This flaw enables an attacker who can create objects in the database to execute arbitrary code as the OS user running the database process. The issue affects PostgreSQL versions before 18.2, 17.8, 16.12, 15.16, and 14.21. Red Hat Product Security has published advisories and released updated packages that fix this vulnerability along with related issues. The CVSS v3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, requiring privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with the ability to create database objects to execute arbitrary code with the privileges of the operating system user running the PostgreSQL server. This can lead to full compromise of the database server and potentially the host system. The vulnerability impacts confidentiality, integrity, and availability of the affected systems.

Red Hat has released security updates that fix this vulnerability in PostgreSQL versions 18.2, 17.8, 16.12, 15.16, and 14.21 and later. Users should apply these official patches as soon as possible. For Red Hat Enterprise Linux users, updated packages are available as part of Extended Update Support 10.0 and other supported releases. Patch status is confirmed by the vendor advisory. No alternative mitigations are stated; applying the vendor-provided updates is the recommended remediation.