CVE-2026-2004 PUBLISHED

PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

Assigner: PostgreSQL
Reserved: 05.02.2026 Published: 12.02.2026 Updated: 12.02.2026

Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor n/a
Product PostgreSQL
Versions Default: unaffected
  • affected from 18 to 18.2 (excl.)
  • affected from 17 to 17.8 (excl.)
  • affected from 16 to 16.12 (excl.)
  • affected from 15 to 15.16 (excl.)
  • affected from 0 to 14.21 (excl.)

Affected Configurations

Attacker has permission to install a vulnerable extension, e.g. intarray. Alternatively, a vulnerable extension is already installed, and the attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema).

Credits

  • The PostgreSQL project thanks Daniel Firer, as part of zeroday.cloud, for reporting this problem.

References

Problem Types

  • Improper Validation of Specified Type of Input CWE