This advisory covers three PostgreSQL vulnerabilities that enable arbitrary code execution: CVE-2026-2006 involves missing validation of multibyte character length; CVE-2026-2004 concerns missing validation of the input type to the selectivity estimator in the intarray extension; and CVE-2026-2005 is a heap buffer overflow in the pgcrypto module. These vulnerabilities affect PostgreSQL packages distributed with Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat has issued updated packages to fix these issues as detailed in advisory RHSA-2026:4528. No CVSS scores are provided in the advisory, but the issues are rated as important/high severity. The advisory includes detailed package updates and references for remediation.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code within the context of the PostgreSQL server process. This could lead to unauthorized code execution and potential compromise of the database server. The vulnerabilities affect critical PostgreSQL components including multibyte character handling, the intarray extension, and the pgcrypto module. The impact is rated as high severity by Red Hat Product Security.

Red Hat has released updated PostgreSQL packages for Red Hat Enterprise Linux 9.6 Extended Update Support that address these vulnerabilities. Users should apply these official security updates as soon as possible to remediate the issues. For detailed instructions on applying the updates, refer to the Red Hat advisory RHSA-2026:4528 and the linked article https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are specified in the advisory.