High severity8.8NVD Advisory· Published Aug 13, 2026· Updated Aug 29, 2026
CVE-2026-19385
CVE-2026-19385
Description
Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
51- osv-coords50 versionspkg:rpm/opensuse/postgresql17&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/postgresql18-plperlpkg:rpm/almalinux/postgresql18-test-rpm-macrospkg:rpm/almalinux/postgresql-plpython3pkg:rpm/almalinux/postgresql-pltclpkg:rpm/almalinux/postgresql-upgrade-develpkg:rpm/almalinux/postgresql18-upgradepkg:rpm/almalinux/postgresql18-upgrade-develpkg:rpm/almalinux/postgresql18-contribpkg:rpm/almalinux/pg_repackpkg:rpm/almalinux/postgresql18-plpython3pkg:rpm/almalinux/postgresql18-private-develpkg:rpm/almalinux/postgresql18-server-develpkg:rpm/almalinux/pgauditpkg:rpm/almalinux/pgvectorpkg:rpm/almalinux/postgis-utilspkg:rpm/almalinux/postgres-decoderbufspkg:rpm/almalinux/postgresqlpkg:rpm/almalinux/postgresql18-docspkg:rpm/almalinux/postgresql-server-develpkg:rpm/almalinux/postgresql-staticpkg:rpm/almalinux/postgresql18-staticpkg:rpm/almalinux/postgis-docspkg:rpm/almalinux/postgis-upgradepkg:rpm/almalinux/postgresql-contribpkg:rpm/almalinux/postgresql-docspkg:rpm/almalinux/postgresql-private-develpkg:rpm/almalinux/postgresql-private-libspkg:rpm/almalinux/postgresql-serverpkg:rpm/almalinux/postgresql-testpkg:rpm/almalinux/postgresql-upgradepkg:rpm/almalinux/postgresql18pkg:rpm/almalinux/postgispkg:rpm/almalinux/postgis-clientpkg:rpm/opensuse/postgresql18&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/postgresql15&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/postgresql14&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/postgresql16&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/postgresql16&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/postgresql18-serverpkg:rpm/almalinux/postgresql18-testpkg:rpm/opensuse/postgresql14&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/postgresql15&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/postgresql17&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/postgresql18&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/postgresql18-mini&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/postgresql18-private-libspkg:rpm/almalinux/postgresql-plperlpkg:rpm/almalinux/postgresql-test-rpm-macrospkg:bitnami/postgresql
< 17.11-1.1+ 49 more
- (no CPE)range: < 17.11-1.1
- (no CPE)range: < 18.6-1.el10_2
- (no CPE)range: < 18.6-1.el10_2
- (no CPE)range: < 16.15-1.module_el9.8.0+311+c39b793b
- (no CPE)range: < 16.15-1.module_el9.8.0+311+c39b793b
- (no CPE)range: < 16.15-1.module_el9.8.0+311+c39b793b
- (no CPE)range: < 18.6-1.el10_2
- (no CPE)range: < 18.6-1.el10_2
- (no CPE)range: < 18.6-1.el10_2
- (no CPE)range: < 1.5.1-1.module_el9.6.0+146+c54fdeca
- (no CPE)range: < 18.6-1.el10_2
- (no CPE)range: < 18.6-1.el10_2
- (no CPE)range: < 18.6-1.el10_2
- (no CPE)range: < 16.0-1.module_el9.4.0+66+eb9878bc
- (no CPE)range: < 0.6.2-2.module_el9.6.0+167+4e561146
- (no CPE)range: < 3.5.3-6.module_el9.8.0+311+c39b793b
- (no CPE)range: < 2.4.0-1.Final.module_el9.4.0+66+eb9878bc
- (no CPE)range: < 16.15-1.module_el9.8.0+311+c39b793b
- (no CPE)range: < 18.6-1.el10_2
- (no CPE)range: < 16.15-1.module_el9.8.0+311+c39b793b
- (no CPE)range: < 16.15-1.module_el9.8.0+311+c39b793b
- (no CPE)range: < 18.6-1.el10_2
- (no CPE)range: < 3.5.3-6.module_el9.8.0+311+c39b793b
- (no CPE)range: < 3.5.3-6.module_el9.8.0+311+c39b793b
- (no CPE)range: < 16.15-1.module_el9.8.0+311+c39b793b
- (no CPE)range: < 16.15-1.module_el9.8.0+311+c39b793b
- (no CPE)range: < 16.15-1.module_el9.8.0+311+c39b793b
- (no CPE)range: < 16.15-1.module_el9.8.0+311+c39b793b
- (no CPE)range: < 16.15-1.module_el9.8.0+311+c39b793b
- (no CPE)range: < 16.15-1.module_el9.8.0+311+c39b793b
- (no CPE)range: < 16.15-1.module_el9.8.0+311+c39b793b
- (no CPE)range: < 18.6-1.el10_2
- (no CPE)range: < 3.5.3-6.module_el9.8.0+311+c39b793b
- (no CPE)range: < 3.5.3-6.module_el9.8.0+311+c39b793b
- (no CPE)range: < 18.6-1.1
- (no CPE)range: < 15.19-1.1
- (no CPE)range: < 14.24-1.1
- (no CPE)range: < 16.15-1.1
- (no CPE)range: < 16.15-160000.1.1
- (no CPE)range: < 18.6-1.el10_2
- (no CPE)range: < 18.6-1.el10_2
- (no CPE)range: < 14.24-160000.1.1
- (no CPE)range: < 15.19-160000.1.1
- (no CPE)range: < 17.11-160000.1.1
- (no CPE)range: < 18.6-160000.1.1
- (no CPE)range: < 18.6-160000.1.1
- (no CPE)range: < 18.6-1.el10_2
- (no CPE)range: < 16.15-1.module_el9.8.0+311+c39b793b
- (no CPE)range: < 16.15-1.module_el9.8.0+311+c39b793b
- (no CPE)range: < 14.24.0
- Range: <18.6, <17.11, <16.15, <15.19, <14.24
Patches
Vulnerability mechanics
References
1- www.postgresql.org/support/security/CVE-2026-19385/nvdVendor Advisory
News mentions
1- PostgreSQL: 25 Vulnerabilities Disclosed, Many Allowing Code ExecutionVypr Intelligence · Aug 13, 2026