PostgreSQL Anonymizer EUVD-2026-112286

Requires that the PostgreSQL Anonymizer extension (version prior to 3.3.0) be installed and that the anon.image_blur() function be invoked on an attacker-controlled image whose declared dimensions are not validated against its actual data. Two conditions limit real-world impact: (1) a user or operator must actually run image_blur() over the malicious image (the UI:R requirement), which fits the data-masking workflow where a DBA anonymizes stored data; and (2) the full cluster-wide crash-recovery outcome occurs only 'when overcommit is on' on the host - without memory overcommit the effect is bounded to a failed allocation in the affected backend. Impact is limited to availability only; there is no confidentiality or integrity exposure.

This is a genuine but moderate-priority availability issue, not a widespread emergency. The official CVSS 3.1 base score is 4.7 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L - network vector and low complexity, but the only impact is availability (A:L), with no confidentiality or integrity impact, and exploitation requires user interaction (UI:R). The scope-changed flag (S:C) reflects that an OOM-kill of one backend forces a cluster-wide crash-recovery, so the blast radius exceeds the single affected process. The vuln.today decision label is 'this_month' (not act_now or emergency), consistent with the medium severity. No EPSS score and no KEV listing were provided, and there is no confirmed public exploit - only a GitLab issue reference - so there is no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis.' One important caveat the description makes explicit: the cluster crash only occurs 'when overcommit is on,' so the worst-case outcome is conditional on host memory configuration (the description's 'ovecommit' is a typo for overcommit). Note also a tension worth verifying: the official vector lists PR:N (unauthenticated), yet invoking anon.image_blur() realistically requires database access to execute SQL and typically an operator running the anonymization step on attacker-supplied image data (which is why UI:R is set) - treat the raw 'unauthenticated' reading with caution.

An attacker places a small image whose header declares enormous pixel dimensions into a database column that will be processed by the PostgreSQL Anonymizer masking workflow. When an operator runs anon.image_blur() over that data, the function trusts the declared dimensions and attempts a huge memory allocation, exhausting the backend's memory. On a host with memory overcommit enabled, the Linux OOM-killer terminates the backend, triggering a cluster-wide crash-recovery. No public exploit code is identified at time of analysis; only a vendor GitLab issue is referenced.