High severity · published Feb 12, 2026
CVE-2026-2007
Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string
8.2
CVSS
0.5%
EPSS
No
On KEV
Description
Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string. The attacker has limited control over the byte patterns to be written, but we have not ruled out the viability of attacks that lead to privilege escalation. PostgreSQL 18.1 and 18.0 are affected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
PostgreSQL · PostgreSQL
18.0 before 18.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2007
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2007
Vendor Advisory
https://www.postgresql.org/support/security/CVE-2026-2007/
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:19009
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:8756
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-2007
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2439320
security.access.redhat.com
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2007.json
More from PostgreSQL
9.8
CVE-2015-0244
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message,…
9.8
CVE-2015-3166
The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call…
9.8
CVE-2019-10211
Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unprotected directory
9.8
CVE-2018-16850
postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER
9.8
CVE-2017-7546
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts…