CVE-2026-2005 — PostgreSQL pgcrypto Heap Buffer Overflow

Target commit: 4b324845ba5d24682b9b3708a769f00d160afbd7 (PostgreSQL 18.1 — vulnerable)

Summary

Quick Start

# Build and start PostgreSQL 18.1 (vulnerable)
docker compose up -d --build

# Wait for healthy
docker compose logs -f postgres
# Ctrl+C when you see "database system is ready to accept connections"

# One-time setup: copy the postgres binary for offline symbol parsing
docker cp cve-2026-2005-poc:/usr/local/pgsql/bin/postgres ./postgres

# Install node deps
npm install

# Run the full RCE exploit chain (pure SQL — no Docker interaction)
node exploit.js --cmd "id"

# With verbose output
node exploit.js --cmd "id" --verbose

# Execute a custom command
node exploit.js --cmd "whoami"

Exploit Chain (7 stages)

Stage 1: Heap pointer leak
  └─ Corrupt mdst chunk header → parse pfree() error message

Stage 2: Arbitrary read (multi-window scan)
  └─ Overwrite mdst->data → scan memory near leaked pointer

Stage 3: Pointer candidate collection
  └─ Scan heap dumps for pointer-like 8-byte values

Stage 4: PIE base resolution
  └─ Vote leaked addresses against ELF symbol offsets (page-offset
     grouped, offline — symbols parsed from the local binary copy)

Stage 5: PIE validation
  └─ Arb read CurrentUserId at candidate base → compare with session OID

Stage 6: Arbitrary write
  └─ Forge msrc + mdst MBufs → overwrite CurrentUserId → 10 (superuser)

Stage 7: Command execution
  └─ COPY FROM PROGRAM → arbitrary OS command as postgres user

File Structure

CVE-2026-2005/
├── Dockerfile              # Builds PostgreSQL 18.1 from source
├── docker-compose.yml      # PostgreSQL service with auto-restart
├── init.sh                 # Entrypoint — initdb + listen config
├── README.md               # This file
└── poc/
    ├── package.json        # Node.js dependencies (pg)
    ├── exploit.js          # Full 7-stage RCE exploit (Node.js)
    ├── verify.sh           # Shell-based quick verification
    └── test-pgcrypto.sql   # SQL-only test of pgcrypto loading

Manual Build (macOS / Linux)

git clone https://github.com/postgres/postgres.git
cd postgres
git checkout 4b324845ba5d24682b9b3708a769f00d160afbd7
./configure \
    --prefix="$HOME/projects/pg/pgsql" \
    --with-libxml \
    --with-libxslt \
    --enable-debug \
    --with-ssl=openssl
make -j$(nproc)
make install-world-bin

Requirements

• Docker + Docker Compose (aarch64 host, e.g. Apple Silicon Mac)
• Node.js ≥ 18
• ~2 GB disk for the PostgreSQL build
• Build takes ~3–5 minutes on first run
• tmux (optional — only needed with --gdb flag)

Vulnerability Details

The bug is in pgp_parse_pubenc_sesskey() in contrib/pgcrypto/pgp-pubdec.c. When parsing an OpenPGP Public-Key Encrypted Session Key packet (tag 1):

1. The code reads the MPI (multi-precision integer) length from the packet
2. Allocates a buffer based on that length
3. RSA-decrypts the MPI into the buffer
4. Reads the session-key length from the decrypted data without bounds validation
5. memcpys session-key data into a fixed-size buffer based on the unvalidated length

The memcpy can write past the heap buffer boundary, corrupting adjacent heap metadata or data, leading to arbitrary code execution.

Exploitation Chain Detail

1. Heap pointer leak — Corrupt malloc chunk header; parse the pfree() error message to extract mdst->data heap address.
2. PIE base resolution — Read /proc/<pid>/maps from the Docker container to find the postgres binary's load address at runtime.
3. Arbitrary write — Forge both msrc (source) and mdst (destination) MBuf structs via the heap overflow. msrc points at an embedded symenc packet containing the superuser OID (10); mdst points at CurrentUserId - 4 (accounting for the 4-byte SET_VARSIZE header).
4. Privilege escalation — With CurrentUserId = 10 (bootstrap superuser), execute COPY FROM PROGRAM to run arbitrary OS commands.

CLI Options

Notes

• The pgcrypto extension is trusted — any user with CREATE privilege (not superuser) can install it, making this exploitable with low privileges.
• The Docker build includes --enable-debug for easier debugging with gdb.
• Heap offsets (SRC_CHUNK_OFFSET=100, DST_CHUNK_OFFSET=172) are specific to aarch64 + glibc — other architectures/allocators need different offsets.
• PIE base is resolved from the leaked heap pointers via symbol-offset voting, then confirmed by reading CurrentUserId through the same arbitrary-read primitive.

References

• PostgreSQL Security Advisory
• ZeroDay.Cloud Technical Writeup
• NVD Entry