CVE-2026-2003

PostgreSQL oidvector discloses a few bytes of memory

State: Published
Severity: 4.3 Medium
Published: Feb 12, 2026
Updated: Feb 12, 2026
Reserved: Feb 5, 2026

Description

Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	PostgreSQL

Weaknesses

CWE-1287 Improper Validation of Specified Type of Input

Affected Products

Product	Versions
PostgreSQLn/a	18 to before 18.2Affected 17 to before 17.8Affected 16 to before 16.12Affected 15 to before 15.16Affected before 14.21Affected

References

https://www.postgresql.org/support/security/CVE-2026-2003/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.