CVE-2026-19385

Details

Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Affected Packages

PostgreSQL

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1703)Windows 10 (1709)Windows 10 (1803)

Fixed in:

14.2415.1916.1517.1118.6

postgresql@14

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@15

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@16

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@17

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@18

brew

Fixed in:

14.2415.1916.1517.1118.6

References

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-19385

WEB

https://www.postgresql.org/support/security/CVE-2026-19385/