CVE-2026-19385 - PostgreSQL pg_dump heap buffer overflow executes arbitrary code

First Published: 2026/08/13

Important: This assessment evaluates the impact of CVE-2026-19385 on EDB products and services. It links to and details the CVE and supplements that information with EDB's own assessment.

Summary

A heap buffer overflow in pg_dump allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Vulnerability details

CVE-ID: CVE-2026-19385

CVE Publish Date: 2026/08/13

CVSS Base Score: 8.8

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products and versions

PostgreSQL

• All versions prior to 18.5
• All versions prior to 17.11
• All versions prior to 16.15
• All versions prior to 15.19
• All versions prior to 14.24

EnterpriseDB Postgres Advanced Server (EPAS)

• All versions prior to 18.5
• All versions prior to 17.11
• All versions prior to 16.15
• All versions prior to 15.19
• All versions prior to 14.24

EnterpriseDB Postgres Extended (PGE)

• All versions prior to 18.5
• All versions prior to 17.11
• All versions prior to 16.15
• All versions prior to 15.19
• All versions prior to 14.24

CloudNativePG

• All operand versions prior to 18.5
• All operand versions prior to 17.11
• All operand versions prior to 16.15
• All operand versions prior to 15.19
• All operand versions prior to 14.24

WarehousePG

• All 7.x versions up to and including 7.5.0

Remediation/fixes

PostgreSQL

EDB Postgres Extended Server

EDB Postgres Advanced Server

CloudNativePG

Customer should update to the fixed version of the PostgreSQL operands.

WarehousePG

Fixes will be included in the next minor release of WarehousePG 7.x.

References

• CVSS Calculator v3.1
• NVD - CVE-2026-19385 Detail
• https://www.postgresql.org/support/security/CVE-2026-19385/

Related information

• EnterpriseDB
• EDB Blogs link

Acknowledgement

Source: PostgreSQL.org