CVE-2026-2003

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-1287

Affected software

No affected versions have been published.

Timeline

Published
Feb 12, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-2003010.0As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a compreCVE-2026-200315.3A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial CVE-2026-200324.4A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escapeCVE-2026-200337.4A vulnerability in Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an unauthenticated, adjacent attacker to cause a denial oCVE-2026-200348.8A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbCVE-2026-200357.2A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks thCVE-2026-200366.5A vulnerability in the CLI and web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker wiCVE-2026-200374.4A vulnerability in the NX-OS CLI privilege levels of Cisco UCS Manager Software could allow an authenticated, local attacker with read-only CVE-2026-200385.8A vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode could allow an unaCVE-2026-200398.6A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat DCVE-2026-20048.8Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbiCVE-2026-200408.8A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on th