The flaw is a heap buffer overflow in PostgreSQL’s regular‑expression engine. When a query contains text that does not pass normal encoding validation, data can grow unexpectedly during conversion through pg_wchar, allowing the query author to execute arbitrary code with the privileges of the database process, which runs as the operating system user. This is also related to CVE‑2026‑2006, but the issue here is unanticipated data growth during round‑tripping through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are vulnerable.

PostgreSQL database instances running versions before 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. The vulnerability is specific to the standard PostgreSQL distribution.

The CVSS score of 8.8 indicates high severity for remote code execution, and the EPSS score of 0.00436 indicates a very low but non‑zero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The attack can be carried out by an attacker who can inject a crafted query through the database client, whether from a local or remote source, and trigger the overflow during regex processing.