CVE-2026-18024
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A buffer over-read vulnerability was found in PostgreSQL's ascii() SQL function, allowing a user to disclose up to 3 bytes after the end of a specific allocation via a crafted text value. This is the same class of defect fixed in CVE-2026-2006, though this instance has less impact. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Risk Assessment
The risk includes potential disclosure of memory fragments, which may lead to leakage of sensitive data stored in server memory.
Recommendation
Upgrade PostgreSQL to a patched version and restrict access to the ascii() function to trusted users only.
Original NVD description (English source)
Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.