CVEvulnerability

CVE-2026-2004

8.8 HIGH Published 2026-02-12 Modified 2026-07-15 Official page ↗
Status
Modified
Published
2026-02-12
Last modified
2026-07-15
Assigner
f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
CVSS 3.1 (f86ef6dc-4d3a-42ad-8f28-e6d5547a5007)
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1287

Description

Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

Affected configurations

• postgresql postgresql (>= 14.0 < 14.21) • postgresql postgresql (>= 15.0 < 15.16) • postgresql postgresql (>= 16.0 < 16.12) • postgresql postgresql (>= 17.0 < 17.8) • postgresql postgresql (>= 18.0 < 18.2)

Related

Weakness · CWE (1)

  • CWE-1287 Improper Validation of Specified Type of Input weakness

References