CVE-2026-2005 — PostgreSQL pgcrypto Heap Buffer Overflow

Target commit: 4b324845ba5d24682b9b3708a769f00d160afbd7 (PostgreSQL 18.1 — vulnerable)

Summary

Quick Start

# Build and start PostgreSQL 18.1 (vulnerable)
docker compose up -d --build

# Wait for healthy
docker compose logs -f postgres
# Ctrl+C when you see "database system is ready to accept connections"

# Install node deps
npm install

# Run the full RCE exploit chain
node exploit.js --cmd "id"

# With verbose output
node exploit.js --cmd "id" --verbose

# Execute a custom command
node exploit.js --cmd "whoami"

Exploit Chain (7 stages)

Stage 1: Heap pointer leak
  └─ Corrupt mdst chunk header → parse pfree() error message

Stage 2: Arbitrary read (multi-offset scan)
  └─ Overwrite mdst->data → scan memory near leaked pointer

Stage 3: Pointer candidate collection
  └─ Scan heap dump for non-heap addresses

Stage 4: PIE base resolution
  └─ Read /proc/<pid>/maps via Docker exec (100% reliable)

Stage 5: (skipped — PIE base is known from maps)

Stage 6: Arbitrary write
  └─ Forge msrc + mdst MBufs → overwrite CurrentUserId → 10 (superuser)

Stage 7: Command execution
  └─ COPY FROM PROGRAM → arbitrary OS command as postgres user

File Structure

CVE-2026-2005/
├── Dockerfile              # Builds PostgreSQL 18.1 from source
├── docker-compose.yml      # PostgreSQL service with auto-restart
├── init.sh                 # Entrypoint — initdb + listen config
├── README.md               # This file
└── poc/
    ├── package.json        # Node.js dependencies (pg)
    ├── exploit.js          # Full 7-stage RCE exploit (Node.js)
    ├── verify.sh           # Shell-based quick verification
    └── test-pgcrypto.sql   # SQL-only test of pgcrypto loading

Manual Build (macOS / Linux)

git clone https://github.com/postgres/postgres.git
cd postgres
git checkout 4b324845ba5d24682b9b3708a769f00d160afbd7
./configure \
    --prefix="$HOME/projects/pg/pgsql" \
    --with-libxml \
    --with-libxslt \
    --enable-debug \
    --with-ssl=openssl
make -j$(nproc)
make install-world-bin

Requirements

• Docker + Docker Compose (aarch64 host, e.g. Apple Silicon Mac)
• Node.js ≥ 18
• ~2 GB disk for the PostgreSQL build
• Build takes ~3–5 minutes on first run
• tmux (optional — only needed with --gdb flag)

Vulnerability Details

The bug is in pgp_parse_pubenc_sesskey() in contrib/pgcrypto/pgp-pubdec.c. When parsing an OpenPGP Public-Key Encrypted Session Key packet (tag 1):

1. The code reads the MPI (multi-precision integer) length from the packet
2. Allocates a buffer based on that length
3. RSA-decrypts the MPI into the buffer
4. Reads the session-key length from the decrypted data without bounds validation
5. memcpys session-key data into a fixed-size buffer based on the unvalidated length

The memcpy can write past the heap buffer boundary, corrupting adjacent heap metadata or data, leading to arbitrary code execution.

Exploitation Chain Detail

1. Heap pointer leak — Corrupt malloc chunk header; parse the pfree() error message to extract mdst->data heap address.
2. PIE base resolution — Read /proc/<pid>/maps from the Docker container to find the postgres binary's load address at runtime.
3. Arbitrary write — Forge both msrc (source) and mdst (destination) MBuf structs via the heap overflow. msrc points at an embedded symenc packet containing the superuser OID (10); mdst points at CurrentUserId - 4 (accounting for the 4-byte SET_VARSIZE header).
4. Privilege escalation — With CurrentUserId = 10 (bootstrap superuser), execute COPY FROM PROGRAM to run arbitrary OS commands.

CLI Options

Notes

• The pgcrypto extension is trusted — any user with CREATE privilege (not superuser) can install it, making this exploitable with low privileges.
• The Docker build includes --enable-debug for easier debugging with gdb.
• Heap offsets (SRC_CHUNK_OFFSET=100, DST_CHUNK_OFFSET=172) are specific to aarch64 + glibc — other architectures/allocators need different offsets.
• The container uses restart: always to auto-recover from backend crashes during PIE candidate testing.
• PIE base is resolved via /proc/<pid>/maps inside the Docker container — no readelf needed on the host.
• Symbol table for CurrentUserId offset is read via docker exec readelf.

References

• PostgreSQL Security Advisory
• ZeroDay.Cloud Technical Writeup
• NVD Entry