CVE-2026-19385
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list.
Risk Assessment
Risk of arbitrary code execution on the client machine during backup, potentially leading to system compromise.
Recommendation
Update PostgreSQL to versions 18.5, 17.11, 16.15, 15.19, or 14.24 or later, which include a fix for this vulnerability.
Original NVD description (English source)
Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.