CVE-2026-2004 — PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code
Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system us…
Published: 2026-02-12 · CVSS: 8.8 · CVSS 3.1
Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7