CVE-2026-2004
PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code
8.8
HIGH
CVSS 3.1
EPSS 0.78%
Description
Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
How to fix CVE-2026-2004
To remediate CVE-2026-2004, upgrade the affected package to a fixed version below.
- —upgrade to 14.21.0 or later
Is CVE-2026-2004 being exploited?
Low — EPSS is 0.8%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 14.21.0, >= 15.0.0, < 15.16.0, >= 16.0.0, < 16.12.0, >= 17.0.0, < 17.8.0, >= 18.0.0, < 18.2.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |