PostgreSQL pg_dump EUVD-2026-57853

The attacker must hold an authenticated PostgreSQL database session with sufficient privileges to create database objects - specifically, CREATE privilege on at least one database or schema, which is granted to non-superuser roles in many deployments for application DDL operations. The crafted object must include a function transform list long enough to overflow pg_dump's heap allocation. Exploitation triggers when pg_dump is subsequently executed against the database containing the malicious object, so the attacker does not need direct control over when pg_dump runs - they rely on normal backup scheduling. What limits exploitation: (1) the attacker cannot exploit this without an authenticated database account with CREATE privileges; (2) exploitation is indirect - the attacker cannot trigger pg_dump themselves unless they also have OS-level access; (3) impact is scoped to the OS user running pg_dump, not the PostgreSQL server process itself. The flaw does not affect normal database query operations - only the pg_dump utility code path processes transform lists in the vulnerable manner.

The CVSS 8.8 score reflects AV:N/AC:L/PR:L/UI:N - network-reachable, low complexity, requiring only a low-privileged database account, and no user interaction. The PR:L signal is important: exploitation is gated behind the ability to create database objects, which requires an authenticated database session with CREATE privileges. This meaningfully narrows the attacker pool compared to a PR:N flaw. However, the attack is asymmetric: an attacker plants a malicious object once, then waits for automated pg_dump backup jobs to trigger the payload, often running under highly privileged OS accounts. EPSS data is not provided in available intelligence, and this CVE is not listed in CISA KEV, meaning active exploitation is not confirmed. No POC has been identified. The absence of KEV listing and POC tempers urgency, but the reliable heap overflow trigger and high-value execution context (backup service accounts often have read access to entire filesystems and all database content) elevate real-world impact beyond what the CVSS base score alone conveys. Priority should be higher for organizations with untrusted or semi-trusted database users and automated backup pipelines.

A contractor or developer with a low-privileged PostgreSQL account on a shared database server creates a PL/Python or PL/Perl function with an abnormally long transform list crafted to overflow the heap buffer in pg_dump's transform serialization code. The malicious object sits dormant in the database until the nightly automated pg_dump backup job - running as the 'postgres' OS user or a dedicated backup account - processes that database. The heap overflow triggers during object enumeration, allowing the attacker's embedded payload to execute as the OS user running pg_dump, potentially yielding access to backup files, database credentials, and the broader filesystem.