PostgreSQL CVE-2026-18024

Exploitation requires an authenticated database session - the CVSS vector PR:L confirms low-privilege authenticated access is sufficient; unauthenticated exploitation is not possible. The attacker must be able to execute arbitrary SQL, specifically invoking the ascii() function with a crafted text argument. No special non-default configuration is required beyond having a valid database login. Limiting factors include: the requirement for a database credential, the 3-byte maximum disclosure per invocation, and the fact that heap layout is not deterministic, making targeted disclosure of specific secrets difficult. The vulnerability does not affect integrity or availability.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3) accurately reflects the limited blast radius: network-reachable, low complexity, but requiring authenticated access and producing only a partial confidentiality impact. No integrity or availability impact is possible. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, consistent with its low exploitability profile. No public exploit or POC has been identified. The realistic threat actor is a malicious or compromised authenticated database user seeking to leak heap metadata - not an external unauthenticated attacker. For most deployments this is a lower-priority patch-cycle item, though even a mid-sized municipal IT team in mielec running PostgreSQL on sensitive citizen data should not indefinitely defer the fix given that multi-version patches are readily available. The 3-byte disclosure limit substantially constrains the practical usefulness of any leaked data.

An authenticated database user submits a crafted SQL query such as SELECT ascii(malicious_text_value) designed to position the allocation boundary so that the over-read exposes adjacent heap bytes. The returned value or an error side-channel could leak up to 3 bytes of memory contents. No public exploit code exists at time of analysis, and the 3-byte ceiling sharply limits what an attacker can recover.