CVE-2026-2007 PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory
A heap buffer overflow in PostgreSQL pg_trgm allows attackers to write to server memory, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-2007?
CVE-2026-2007 is a high-severity memory corruption vulnerability in Postgresql Postgresql, published on 12 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string. The attacker has limited control over the byte patterns to be written, but we have not ruled out the viability of attacks that lead to privilege escalation. PostgreSQL 18.1 and 18.0 are affected.
Which versions are affected by CVE-2026-2007?
1 open source package ship an affected version, including postgresql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
postgresql Bitnami | From 18.0.0 | 18.2.0 |
Products include Postgresql Postgresql.
How do I fix CVE-2026-2007?
Upgrade postgresql to 18.2.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-2007 being exploited?
There is no known exploitation of CVE-2026-2007 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as ALPINE-CVE-2026-2007, BELL-CVE-2026-2007, BIT-postgresql-2026-2007, DEBIAN-CVE-2026-2007, GHSA-5pr9-9395-q5gq, MINI-3mpx-33w2-j3j2 and 1 more.