1. Home
  2. CVE Database
  3. CVE-2026-2003
MEDIUM · 4.3

CVE-2026-2003

Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confiden...

Vulnerability Description

Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
PostgresqlPostgresql>= 14.0, < 14.21

Related Weaknesses (CWE)

CWE-1287

References

FAQ

What is CVE-2026-2003?

CVE-2026-2003 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confiden...

How severe is CVE-2026-2003?

CVE-2026-2003 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-2003?

Check the references section above for vendor advisories and patch information. Affected products include: Postgresql Postgresql.