PostgreSQL Anonymizer EUVD-2026-112296

Exploitation requires that an administrator has applied PostgreSQL Anonymizer static masking to a table AND that no ANALYZE has yet run on that table (manually or via autovacuum) to overwrite the cached statistics - this is the explicit trigger window stated in the description. The attacker must be an authenticated PostgreSQL user (PR:L) with privileges to read the pg_stats view for the affected relation. What LIMITS exploitation: the exposure is time-bounded and self-healing (any ANALYZE or routine autovacuum eliminates it), the attacker needs valid database credentials, and only statistical metadata (common values, histograms, min/max bounds) about the original data is exposed - not full row contents. The impact is confined to deployments that rely on static masking and assume it immediately purges all traces of original data.

This is a genuine but low-urgency information-disclosure issue, not a high-severity emergency. The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - meaning low-privileged but authenticated access, no user interaction, and only a limited confidentiality impact (no integrity or availability impact). No EPSS score was supplied, the CVE is not listed in CISA KEV, and no exploit code or working PoC reference was provided (the single reference is a Dalibo GitLab issue-tracker entry, not an exploit). The vuln.today decision label is 'this_month', consistent with a real-but-not-critical finding to be remediated on a normal patch cadence rather than as an emergency. The signals are internally consistent: Medium CVSS, no evidence of exploitation, limited impact scoped to statistical metadata rather than full record contents. The practical risk is that 'anonymized' data is not as protected as an operator assumes, because pre-masking statistics linger in pg_stats; this is an assurance/compliance gap more than a direct breach vector. No key signals are in open conflict, though EPSS is simply absent rather than low.

After an operator runs static masking on a table expecting the original values to be gone, a low-privileged authenticated database user queries the pg_stats view before any ANALYZE (manual or autovacuum) refreshes the statistics, and reads cached statistics - such as most-common-values, histogram bounds, and min/max - that describe the original, unmasked data. No public exploit or PoC code is identified at time of analysis; the only reference is a vendor issue-tracker entry. Exploitation is a straightforward SQL read requiring no special tooling.