PostgreSQL ECPG CVE-2026-16241

Exploitation requires the attacker to hold database server administrator privileges on the PostgreSQL server to which the ECPG client connects - this is the primary hard prerequisite. The malicious server must return a bytea value that omits the mandatory '\x' prefix in its hex representation. The victim must be an application compiled with the ECPG preprocessor (ecpg) and linked against libecpg, actively querying bytea columns or parameters from the controlled server. What limits exploitation: (1) PR:H means the attacker must already control or fully compromise the PostgreSQL server, a high bar; (2) the write primitive uses data outside attacker knowledge, ruling out reliable code execution and limiting impact to crash or rare low-severity memory corruption; (3) ECPG is a niche client library - most PostgreSQL deployments do not use it, significantly reducing the exposed population; (4) scope is unchanged (S:U), so server processes and other clients on the same host are not directly affected.

The CVSS base score of 3.8 (Low) accurately reflects the constrained threat model. AV:N indicates the attack traverses the network (server-to-client), but PR:H - requiring database server administrator privileges - sharply limits the attacker population to those who already control or have fully compromised the PostgreSQL server instance. AC:L confirms no evasion technique is needed once those privileges exist. EPSS data is not supplied, but given the niche ECPG component, low CVSS, and absence of KEV listing or public exploit code, real-world exploitation probability is expected to be very low. The integrity impact (I:L) is rated low and described as rare, meaning most exploitation attempts simply crash the client rather than producing any useful write primitive. No conflict between CVSS signals and description is present. The primary real-world scenario is a rogue or compromised database server attacking a trusting ECPG client application - a threat relevant mainly to environments that cannot guarantee their PostgreSQL server is trustworthy (e.g., shared database hosting, compromised infrastructure). For organizations that fully control and trust their PostgreSQL servers, this vulnerability presents minimal incremental risk.

A threat actor who has achieved database server administrator access (e.g., via credential theft, misconfigured pg_hba.conf, or supply-chain compromise of the server host) crafts a stored bytea value or a custom server response that omits the mandatory '\x' hex prefix. When a legitimate ECPG client application queries this value, the ECPG runtime's length calculation underflows, triggering a massive out-of-bounds memory write that terminates the client process with SIGSEGV, disrupting any application workflow dependent on that ECPG session. No public exploit code is known at time of analysis.