Threats Tagged 'cve-2026-18024'

This security update for PostgreSQL 18 addresses multiple vulnerabilities affecting various components such as psql, logical decoding, pgcrypto, regexp, and others. The issues include heap buffer overflows that can lead to arbitrary code execution, type confusion, integer wraparound causing undersize allocations, privilege enforcement failures, and SQL injection risks. The update fixes these vulnerabilities to improve the security and stability of PostgreSQL 18 and related versions.

A buffer over-read vulnerability exists in the PostgreSQL ascii() SQL function that allows disclosure of up to 3 bytes beyond the allocated buffer when processing a crafted text value. This vulnerability affects multiple PostgreSQL versions prior to 14.24, 15.19, 16.15, 17.11, and 18.6. The issue is similar to a previously fixed defect (CVE-2026-2006) but with less impact. A patch is available to address this vulnerability.

CVE-2026-18024 is a buffer over-read vulnerability in the PostgreSQL ascii() SQL function. It allows a user with limited privileges to read up to 3 bytes beyond the allocated memory by supplying a crafted text value. This vulnerability affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The issue is similar to a previously fixed vulnerability (CVE-2026-2006) but with less impact. The CVSS score is 4.3, indicating a medium severity level.