TI-2026-14846 Aliases CVE-2026-18024 GHSA-mpm7-fx5w-5w53

PostgreSQL ascii() function reads past end of buffer

LOW 20CWE-126Published 2026-08-13 · Updated 2026-08-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-126 and the CVSS impact.

Summary

Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00301 23rd percentileScored 2026-11-07

Fix Partial PostgreSQL: 18.6, 17.11, 16.15 +2Red Hat: 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	PostgreSQL	18 to before 18.6; 17 to before 17.11; 16 to before 16.15; 15 to before 15.19; before 14.24	18.6, 17.11, 16.15, 15.19, 14.24	Patch available	CNA

PostgreSQL Vendor— Affected 18 to before 18.6; 17 to before 17.11; 16 to before 16.15; 15 to before 15.19; before 14.24 Fixed in 18.6, 17.11, 16.15, 15.19, 14.24 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:postgresql:postgresql::::::::	14.0 to before 14.24; 15.0 to before 15.19; 16.0 to before 16.15; 17.0 to before 17.11; 18.0 to before 18.5	Vulnerable	PostgreSQL

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* Versions 14.0 to before 14.24; 15.0 to before 15.19; 16.0 to before 16.15; 17.0 to before 17.11; 18.0 to before 18.5 Vulnerable ·PostgreSQL

Remediation

Fix · CNA PostgreSQL Fixed in 18.6, 17.11, 16.15, 15.19, 14.24

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-08-13
PostgreSQL 14.24, 15.19 and 3 more versions
23 records Highest priority Priority MEDIUM 12 MEDIUM, 11 LOW
Other records, highest priority first
- TI-2026-13579 PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary codePriority MEDIUM 41
- TI-2026-13244 PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparoundPriority MEDIUM 41
- TI-2026-12363 PostgreSQL to_char heap buffer overflow executes arbitrary codePriority MEDIUM 41
Show all 23 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 6	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Self-service automation portal 2	Affected	No fix yet: Fix deferred

Not affected: 1 product

Red Hat Hardened Images

Timeline

2026-10-02 Threatist record created from CVE-2026-18024
2026-10-03 Alias added: GHSA-mpm7-fx5w-5w53

References

Advisory 1

https://www.postgresql.org/support/security/CVE-2026-18024/

TI-2019-06651 In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and… CVSS 3.0HIGH 7.2
TI-2017-05187 Improper authentication in postgresql CVSS 3.0CRITICAL 9.8
TI-2020-15711 SQL injection in postgresql CVSS 3.1HIGH 8.8
TI-2013-01675 Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9… CVSS 2.0MEDIUM 6.5
TI-2007-03176 The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE… CVSS 2.0HIGH 9.0
TI-2022-01423 SQL injection in postgresql CVSS 3.1HIGH 8.8

See all 202 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences