CVE-2026-18024·PostgreSQL vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.20% — higher than 8% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

Update PostgreSQL to version 18.6 or later to address a buffer over-read vulnerability in the ascii() function that could allow authenticated users to leak small amounts of memory. Organizations running PostgreSQL 18.0–18.5 should prioritize this patch, particularly in environments where database access controls may be less restrictive. The vulnerability requires database authentication, limiting its overall risk profile but still warranting timely remediation.

sudo dnf update postgresql-server postgresql-contrib postgresql-libs

How to check if you are affected

1. Step 1: Check PostgreSQL version with: psql --version or SELECT version();
2. Step 2: Query the system catalog to identify if the ascii() function is used in applications: SELECT routine_name FROM information_schema.routines WHERE routine_definition LIKE '%ascii%';
3. Step 3: Search PostgreSQL logs for authentication attempts and ascii() function calls: grep -i 'ascii' /var/log/postgresql/postgresql.log
4. Step 4: After patching, verify the new version with psql --version and confirm the update completed: SELECT version();

FAQ

Related PostgreSQL CVEs

References

• https://www.postgresql.org/support/security/CVE-2026-18024/