Unrated severityNVD Advisory· Published Feb 12, 2026· Updated Feb 26, 2026

PostgreSQL missing validation of multibyte character length executes arbitrary code

CVE-2026-2006

Description

Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

137

PostgreSQL/PostgreSQLcpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: < (18.2, 17.8, 16.12, 15.16, 14.21)
osv-coords135 versions
pkg:apk/chainguard/postgresql-13 pkg:apk/wolfi/postgresql-13 pkg:bitnami/postgresql pkg:rpm/almalinux/pgaudit pkg:rpm/almalinux/pg_repack pkg:rpm/almalinux/pgvector pkg:rpm/almalinux/postgis pkg:rpm/almalinux/postgis-client pkg:rpm/almalinux/postgis-docs pkg:rpm/almalinux/postgis-upgrade pkg:rpm/almalinux/postgis-utils pkg:rpm/almalinux/postgres-decoderbufs pkg:rpm/almalinux/postgresql pkg:rpm/almalinux/postgresql18 pkg:rpm/almalinux/postgresql18-contrib pkg:rpm/almalinux/postgresql18-docs pkg:rpm/almalinux/postgresql18-plperl pkg:rpm/almalinux/postgresql18-plpython3 pkg:rpm/almalinux/postgresql18-private-devel pkg:rpm/almalinux/postgresql18-private-libs pkg:rpm/almalinux/postgresql18-server pkg:rpm/almalinux/postgresql18-server-devel pkg:rpm/almalinux/postgresql18-static pkg:rpm/almalinux/postgresql18-test pkg:rpm/almalinux/postgresql18-test-rpm-macros pkg:rpm/almalinux/postgresql18-upgrade pkg:rpm/almalinux/postgresql18-upgrade-devel pkg:rpm/almalinux/postgresql-contrib pkg:rpm/almalinux/postgresql-docs pkg:rpm/almalinux/postgresql-plperl pkg:rpm/almalinux/postgresql-plpython3 pkg:rpm/almalinux/postgresql-pltcl pkg:rpm/almalinux/postgresql-private-devel pkg:rpm/almalinux/postgresql-private-libs pkg:rpm/almalinux/postgresql-server pkg:rpm/almalinux/postgresql-server-devel pkg:rpm/almalinux/postgresql-static pkg:rpm/almalinux/postgresql-test pkg:rpm/almalinux/postgresql-test-rpm-macros pkg:rpm/almalinux/postgresql-upgrade pkg:rpm/almalinux/postgresql-upgrade-devel pkg:rpm/opensuse/postgresql14&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/postgresql14&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/postgresql14&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/postgresql15&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/postgresql15&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/postgresql15&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/postgresql16&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/postgresql16&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/postgresql16&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/postgresql17&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/postgresql17&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/postgresql17&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/postgresql18&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/postgresql18&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/postgresql18&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/postgresql18-mini&distro=openSUSE%20Leap%2016.0 pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP7 pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7 pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6 pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5 pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP7 pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6 pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5 pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP7 pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7 pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7 pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6 pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5 pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7 pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7 pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7 pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6 pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7 pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7 pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7 pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6 pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5
< 13.23-r5+ 134 more
- (no CPE)range: < 13.23-r5
- (no CPE)range: < 13.23-r5
- (no CPE)range: < 14.21.0
- (no CPE)range: < 1.7.0-1.module_el9.3.0+52+21733919
- (no CPE)range: < 1.4.8-2.module_el9.5.0+119+18833d03
- (no CPE)range: < 0.6.2-2.module_el9.6.0+167+4e561146
- (no CPE)range: < 3.5.3-3.module_el9.7.0+187+2286ff0a
- (no CPE)range: < 3.5.3-3.module_el9.7.0+187+2286ff0a
- (no CPE)range: < 3.5.3-3.module_el9.7.0+187+2286ff0a
- (no CPE)range: < 3.5.3-3.module_el9.7.0+187+2286ff0a
- (no CPE)range: < 3.5.3-3.module_el9.7.0+187+2286ff0a
- (no CPE)range: < 1.9.7-1.Final.module_el9.3.0+52+21733919
- (no CPE)range: < 16.13-1.el10_2
- (no CPE)range: < 18.3-1.el10_2
- (no CPE)range: < 18.3-1.el10_2
- (no CPE)range: < 18.3-1.el10_2
- (no CPE)range: < 18.3-1.el10_2
- (no CPE)range: < 18.3-1.el10_2
- (no CPE)range: < 18.3-1.el10_2
- (no CPE)range: < 18.3-1.el10_2
- (no CPE)range: < 18.3-1.el10_2
- (no CPE)range: < 18.3-1.el10_2
- (no CPE)range: < 18.3-1.el10_2
- (no CPE)range: < 18.3-1.el10_2
- (no CPE)range: < 18.3-1.el10_2
- (no CPE)range: < 18.3-1.el10_2
- (no CPE)range: < 18.3-1.el10_2
- (no CPE)range: < 16.13-1.el10_2
- (no CPE)range: < 16.13-1.el10_2
- (no CPE)range: < 16.13-1.el10_2
- (no CPE)range: < 16.13-1.el10_2
- (no CPE)range: < 16.13-1.el10_2
- (no CPE)range: < 16.13-1.el10_2
- (no CPE)range: < 16.13-1.el10_2
- (no CPE)range: < 16.13-1.el10_2
- (no CPE)range: < 16.13-1.el10_2
- (no CPE)range: < 16.13-1.el10_2
- (no CPE)range: < 16.13-1.el10_2
- (no CPE)range: < 16.13-1.el10_2
- (no CPE)range: < 16.13-1.el10_2
- (no CPE)range: < 16.13-1.el10_2
- (no CPE)range: < 14.22-150600.16.28.1
- (no CPE)range: < 14.21-160000.1.1
- (no CPE)range: < 14.21-1.1
- (no CPE)range: < 15.17-150600.16.28.1
- (no CPE)range: < 15.16-160000.1.1
- (no CPE)range: < 15.16-1.1
- (no CPE)range: < 16.13-150600.16.30.1
- (no CPE)range: < 16.13-160000.1.1
- (no CPE)range: < 16.12-1.1
- (no CPE)range: < 17.9-150600.13.24.1
- (no CPE)range: < 17.9-160000.1.1
- (no CPE)range: < 17.8-1.1
- (no CPE)range: < 18.3-150600.13.8.1
- (no CPE)range: < 18.3-160000.1.1
- (no CPE)range: < 18.2-1.1
- (no CPE)range: < 18.3-160000.1.1
- (no CPE)range: < 14.22-150200.5.69.1
- (no CPE)range: < 14.22-150200.5.69.1
- (no CPE)range: < 14.22-150600.16.28.1
- (no CPE)range: < 14.22-150600.16.28.1
- (no CPE)range: < 14.21-3.66.1
- (no CPE)range: < 14.22-150200.5.69.1
- (no CPE)range: < 14.22-150200.5.69.1
- (no CPE)range: < 14.22-150600.16.28.1
- (no CPE)range: < 14.21-160000.1.1
- (no CPE)range: < 14.22-150200.5.69.1
- (no CPE)range: < 14.22-150200.5.69.1
- (no CPE)range: < 14.22-150600.16.28.1
- (no CPE)range: < 14.21-160000.1.1
- (no CPE)range: < 14.21-3.66.1
- (no CPE)range: < 15.17-150200.5.54.1
- (no CPE)range: < 15.17-150200.5.54.1
- (no CPE)range: < 15.17-150200.5.54.1
- (no CPE)range: < 15.17-150200.5.54.1
- (no CPE)range: < 15.17-150600.16.28.1
- (no CPE)range: < 15.16-3.50.1
- (no CPE)range: < 15.17-150200.5.54.1
- (no CPE)range: < 15.17-150200.5.54.1
- (no CPE)range: < 15.17-150600.16.28.1
- (no CPE)range: < 15.16-160000.1.1
- (no CPE)range: < 15.17-150200.5.54.1
- (no CPE)range: < 15.17-150200.5.54.1
- (no CPE)range: < 15.17-150600.16.28.1
- (no CPE)range: < 15.16-160000.1.1
- (no CPE)range: < 15.16-3.50.1
- (no CPE)range: < 16.12-150200.5.38.1
- (no CPE)range: < 16.12-150200.5.38.1
- (no CPE)range: < 16.12-150200.5.38.1
- (no CPE)range: < 16.12-150200.5.38.1
- (no CPE)range: < 16.13-150600.16.30.1
- (no CPE)range: < 16.13-150600.16.30.1
- (no CPE)range: < 16.13-150600.16.30.1
- (no CPE)range: < 16.12-3.38.1
- (no CPE)range: < 16.12-150200.5.38.1
- (no CPE)range: < 16.12-150200.5.38.1
- (no CPE)range: < 16.13-150600.16.30.1
- (no CPE)range: < 16.13-160000.1.1
- (no CPE)range: < 16.12-150200.5.38.1
- (no CPE)range: < 16.12-150200.5.38.1
- (no CPE)range: < 16.13-150600.16.30.1
- (no CPE)range: < 16.13-160000.1.1
- (no CPE)range: < 16.12-3.38.1
- (no CPE)range: < 17.8-150200.5.22.1
- (no CPE)range: < 17.8-150200.5.22.1
- (no CPE)range: < 17.8-150200.5.22.1
- (no CPE)range: < 17.8-150200.5.22.1
- (no CPE)range: < 17.9-150600.13.24.1
- (no CPE)range: < 17.9-150600.13.24.1
- (no CPE)range: < 17.9-150600.13.24.1
- (no CPE)range: < 17.8-150200.5.22.1
- (no CPE)range: < 17.8-150200.5.22.1
- (no CPE)range: < 17.9-150600.13.24.1
- (no CPE)range: < 17.9-160000.1.1
- (no CPE)range: < 17.8-150200.5.22.1
- (no CPE)range: < 17.8-150200.5.22.1
- (no CPE)range: < 17.9-150600.13.24.1
- (no CPE)range: < 17.9-160000.1.1
- (no CPE)range: < 18.2-150200.5.6.1
- (no CPE)range: < 18.2-150200.5.6.1
- (no CPE)range: < 18.2-150200.5.6.1
- (no CPE)range: < 18.2-150200.5.6.1
- (no CPE)range: < 18.3-150600.13.8.1
- (no CPE)range: < 18.3-150600.13.8.1
- (no CPE)range: < 18.3-150600.13.8.1
- (no CPE)range: < 18.2-8.6.1
- (no CPE)range: < 18.2-150200.5.6.1
- (no CPE)range: < 18.2-150200.5.6.1
- (no CPE)range: < 18.3-150600.13.8.1
- (no CPE)range: < 18.3-160000.1.1
- (no CPE)range: < 18.2-150200.5.6.1
- (no CPE)range: < 18.2-150200.5.6.1
- (no CPE)range: < 18.3-150600.13.8.1
- (no CPE)range: < 18.3-160000.1.1
- (no CPE)range: < 18.2-8.6.1

Patches

Vulnerability mechanics

References

www.postgresql.org/support/security/CVE-2026-2006/mitre

News mentions

⚡ Weekly Recap: Linux Rootkit, macOS Crypto Stealer, WebSocket Skimmers and More
The Hacker News · May 11, 2026

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000