Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string. The attacker has limited control over the byte patterns to be written, but we have not ruled out the viability of attacks that lead to privilege escalation. PostgreSQL 18.1 and 18.0 are affected.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19009 advisory.

    * postgresql: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory (CVE-2026-2007)

    * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003)

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)

    * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)

    * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:19009 advisory.

    PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package     contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML     documentation for the whole system.  These client programs can be located on the same machine as the     PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.
    The PostgreSQL server can be found in the postgresql-server sub-package.

    Security Fix(es):

    * postgresql: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory (CVE-2026-2007)

    * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003)

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)

    * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)

    * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0881-1 advisory.

    Update to version 18.3 (bsc#1258754).

    Security issues fixed:

    - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory     (bsc#1258008).
    - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to     arbitrary code       execution (bsc#1258009).
    - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary     code execution       (bsc#1258010).
    - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code     execution       (bsc#1258011).
    - CVE-2026-2007: pg_trgm heap buffer overflow can cause to write pattern onto server memory (bsc#1258012).

    Regression fixes:

      - the substring() function raises an error 'invalid byte sequence for encoding' on non-ASCII text values     if the         source of that value is a database column (caused by CVE-2026-2006 fix).
      - a standby may halt and return an error 'could not access status of transaction'.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PostgreSQL installed on the remote host is 18 prior to 18.2. As such, it is potentially affected by a vulnerability:

  - Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted     input string. The attacker has limited control over the byte patterns to be written, but we have not ruled     out the viability of attacks that lead to privilege escalation. PostgreSQL 18.1 and 18.0 are affected.
    (CVE-2026-2007)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0585-1 advisory.

    Update to version 18.2.

    Security issues fixed:

    - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory     (bsc#1258008).
    - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to     arbitrary code       execution (bsc#1258009).
    - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary     code execution       (bsc#1258010).
    - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code     execution       (bsc#1258011).
    - CVE-2026-2007: pg_trgm heap buffer overflow can cause to write pattern onto server memory (bsc#1258012).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0584-1 advisory.

    Update to version 18.2.

    Security issues fixed:

    - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory     (bsc#1258008).
    - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to     arbitrary code       execution (bsc#1258009).
    - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary     code execution       (bsc#1258010).
    - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code     execution       (bsc#1258011).
    - CVE-2026-2007: pg_trgm heap buffer overflow can cause to write pattern onto server memory (bsc#1258012).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e3afc190-0821-11f1-a857-6cc21735f730 advisory.

    The PostgreSQL project reports:

              Improper validation of type oidvector in PostgreSQL               allows a database user to disclose a few bytes of server               memory. We have not ruled out viability of attacks that               arrange for presence of confidential information in               disclosed bytes, but they seem unlikely.


              Missing validation of type of input in PostgreSQL               intarray extension selectivity estimator function allows               an object creator to execute arbitrary code as the               operating system user running the database.


              Heap buffer overflow in PostgreSQL pgcrypto allows a               ciphertext provider to execute arbitrary code as the               operating system user running the database.


              Missing validation of multibyte character length in               PostgreSQL text manipulation allows a database user to               issue crafted queries that achieve a buffer overrun.
              That suffices to execute arbitrary code as the operating               system user running the database.


              Heap buffer overflow in PostgreSQL pg_trgm allows a               database user to achieve unknown impacts via a crafted               input string. The attacker has limited control over the               byte patterns to be written, but we have not ruled out               the viability of attacks that lead to privilege               escalation.


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted     input string. The attacker has limited control over the byte patterns to be written, but we have not ruled     out the viability of attacks that lead to privilege escalation. PostgreSQL 18.1 and 18.0 are affected.
    (CVE-2026-2007)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
318302	RockyLinux 10 : postgresql18 (RLSA-2026:19009)	Nessus	Rocky Linux Local Security Checks	high
315438	RHEL 10 : postgresql18 (RHSA-2026:19009)	Nessus	Red Hat Local Security Checks	high
302108	SUSE SLED15: libecpg6 / libecpg6-32bit / libpq5 / libpq5-32bit / postgresql18 / etc (SUSE-SU-2026:0881-1)	Nessus	SuSE Local Security Checks	high
299757	PostgreSQL 18.x < 18.2 Heap Buffer Overflow (CVE-2026-2007)	Nessus	Databases	high
299712	SUSE SLES12 Security Update : postgresql18 (SUSE-SU-2026:0585-1)	Nessus	SuSE Local Security Checks	high
299707	SUSE SLES15 Security Update : postgresql18 (SUSE-SU-2026:0584-1)	Nessus	SuSE Local Security Checks	high
299011	FreeBSD : PostgreSQL -- Multiple vulnerabilities (e3afc190-0821-11f1-a857-6cc21735f730)	Nessus	FreeBSD Local Security Checks	high
298888	Linux Distros Unpatched Vulnerability : CVE-2026-2007	Nessus	Misc.	high

Detections

Analytics

CVE-2026-2007

high

Tenable Plugins

high

high

high

high

high

high

high

high