VULNERABILITY INTELLIGENCE

CVE-2026-2004

CVSS score8.8 HIGH
EPSS probability1.34%
CISA KEVNot currently listed
Published2026-02-12
Last modified2026-07-15
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

Weakness classification

  • CWE-1287: Improper Validation of Specified Type of Input

Primary references