PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory
Priority MEDIUM 42CWE-122Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- Partial Red Hat: 3 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string. The attacker has limited control over the byte patterns to be written, but we have not ruled out the viability of attacks that lead to privilege escalation. PostgreSQL 18.1 and 18.0 are affected.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00546 45th percentileScored 2026-11-07
Fix Partial PostgreSQL: 18.2Red Hat: 2 advisoriesRed Hat: 3 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | PostgreSQL | 18 to before 18.2 | 18.2 | Patch available | CNA |
- PostgreSQL Vendor— Affected 18 to before 18.2 Fixed in 18.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* | 18.0 to before 18.2 | Vulnerable | PostgreSQL |
- cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* Versions 18.0 to before 18.2 Vulnerable ·PostgreSQL
Remediation
- Fix · CNA PostgreSQL Fixed in 18.2
Red Hat 2 advisories
- RHSA-2026:19009 Released 2026-05-19 · Red Hat rating Importantpostgresql18 security update
- Red Hat Enterprise Linux AppStream (v. 10) postgresql18-18.3-1.el10_2, postgresql18-contrib-18.3-1.el10_2, postgresql18-docs-18.3-1.el10_2 +10
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) postgresql18-test-rpm-macros-18.3-1.el10_2
- RHSA-2026:8756 Released 2026-04-17 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images postgresql18-18.3-1.2.hum1@src
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:19009 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | RHSA-2026:19009 |
| Red Hat Hardened Images | Fixed | RHSA-2026:8756 |
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-02 Threatist record created from CVE-2026-2007
- 2026-10-03 Alias added: GHSA-5pr9-9395-q5gq
References
More Postgresql vulnerabilities
- TI-2019-06651 In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and… CVSS 3.0HIGH 7.2
- TI-2017-05187 Improper authentication in postgresql CVSS 3.0CRITICAL 9.8
- TI-2020-15711 SQL injection in postgresql CVSS 3.1HIGH 8.8
- TI-2013-01675 Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9… CVSS 2.0MEDIUM 6.5
- TI-2007-03176 The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE… CVSS 2.0HIGH 9.0
- TI-2022-01423 SQL injection in postgresql CVSS 3.1HIGH 8.8
Sources
- CVE-2026-2007 · CVE Program
- CVE-2026-2007 · NVD
- FIRST EPSS
- GHSA-5pr9-9395-q5gq · GitHub Advisory Database · CC BY 4.0
- CVE-2026-2007 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences