{"id":"CVE-2026-2006","details":"Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun.  That suffices to execute arbitrary code as the operating system user running the database.  Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.","aliases":["BIT-postgresql-2026-2006"],"modified":"2026-04-03T17:29:13.271956153Z","published":"2026-02-12T14:16:02.470Z","related":["ALSA-2026:3730","ALSA-2026:3887","ALSA-2026:3896","ALSA-2026:4024","ALSA-2026:4059","ALSA-2026:4063","ALSA-2026:4064","ALSA-2026:4110","CGA-633r-3xf9-f87w","MGASA-2026-0041","SUSE-SU-2026:0584-1","SUSE-SU-2026:0585-1","SUSE-SU-2026:0586-1","SUSE-SU-2026:0588-1","SUSE-SU-2026:0614-1","SUSE-SU-2026:0615-1","SUSE-SU-2026:0616-1","SUSE-SU-2026:0768-1","SUSE-SU-2026:0769-1","SUSE-SU-2026:0770-1","SUSE-SU-2026:0771-1","SUSE-SU-2026:0784-1","SUSE-SU-2026:0785-1","SUSE-SU-2026:0786-1","SUSE-SU-2026:0787-1","SUSE-SU-2026:0881-1","SUSE-SU-2026:0882-1","SUSE-SU-2026:0883-1","SUSE-SU-2026:20587-1","SUSE-SU-2026:20588-1","SUSE-SU-2026:20906-1","SUSE-SU-2026:20921-1","openSUSE-SU-2026:10190-1","openSUSE-SU-2026:10191-1","openSUSE-SU-2026:10192-1","openSUSE-SU-2026:10193-1","openSUSE-SU-2026:10197-1","openSUSE-SU-2026:20265-1","openSUSE-SU-2026:20266-1","openSUSE-SU-2026:20388-1","openSUSE-SU-2026:20408-1","openSUSE-SU-2026:20447-1"],"references":[{"type":"ADVISORY","url":"https://www.postgresql.org/support/security/CVE-2026-2006/"}],"affected":[{"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-2006.json","unresolved_ranges":[{"events":[{"introduced":"14.0"},{"fixed":"14.21"}]},{"events":[{"introduced":"15.0"},{"fixed":"15.16"}]},{"events":[{"introduced":"16.0"},{"fixed":"16.12"}]},{"events":[{"introduced":"17.0"},{"fixed":"17.8"}]},{"events":[{"introduced":"18.0"},{"fixed":"18.2"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}