Security researchers have uncovered a series of high and critical vulnerabilities affecting the PostgreSQL and MariaDB databases . Two of the bugs have been active for over 20 years and were discovered with the help of AI tools.
In Wiz’s zeroday.cloud hacking event , researchers used “ Xint Code ,” an AI security analysis tool, and found a serious zero-day flaw in PostgreSQL’s “ pgcrypto ” extension and a heap buffer overflow in MariaDB’s JSON schema validation logic . Both vulnerabilities allowed remote code execution (RCE) on the respective database servers.
The Xint Code team also uncovered a “missing validation” bug in PostgreSQL, hidden for 20 years. This allows attackers to write arbitrary code.
have been released for all of these bugs, with the PostgreSQL and MariaDB maintainers urging users to upgrade to the fixed versions immediately.
See also: Google offers up to $1.5 million for Android exploits
Multiple vulnerabilities in PostgreSQL
The most pressing of the zero-day bugs in PostgreSQL is a heap-based buffer overflow issue, tracked as CVE-2026-2005. As mentioned earlier, it is located in the “pgcrypto” extension. Using specially crafted input, an attacker can cause a size mismatch that leads to out-of-bounds writes to the heap.
In environments where pgcrypto processes user-controlled input, this can be exploited to achieve remote code execution on the database server. The flaw affected all supported versions and has been fixed in updates including v18.2, v17.8, v16.12, v15.16, and v14.21. It received a high severity CVSS rating of 8.8 out of 10.
“The vulnerable code has existed since pgcrypto first appeared in 2005, more than 20 years ago,” the researchers added.
This wasn't the only bug reported in PostgreSQL. Another group of researchers at the Wiz event found a missing validation bug, tracked as CVE-2026-2006, which allows arbitrary code execution. The bug was rated at nearly 9 CVSS and was fixed in the same updates that fixed CVE-2026-2005.
See also: WhatsApp reveals file spoofing and URL scheme vulnerabilities
PostgreSQL maintainers urged customers to quickly patch the bugs as they became public and attackers have access to exploit code. The bugs were patched in February, but an analysis by Wiz found that of the 80% of cloud environments using PostgreSQL, 45% are directly exposed to the internet.
Insufficient JSON parsing allowed RCE in MariaDB server
A buffer overflow bug has been identified in MariaDB, tracked as CVE-2026-32710 . It was found in the JSON_SCHEMA_VALID() function (via Xint Code). The vulnerability allows an authorized user to cause a crash , which, under controlled conditions, could escalate to remote code execution .
Compared to the PostgreSQL bugs, the exploitation here is less straightforward. Successful code execution would require manipulation of the memory layout, which is only possible in “lab environments.”
See also: Hackers exploit Weaver E-cology vulnerability
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
" Any user who can open a SQL session — whether through stolen credentials, SQL injection, or lateral movement — can reach this code path with a single function call ," Team Xint Code said in a separate blog post
versions 11.4.1-11.4.9 and 11.8.1-11.8.5 are affected, with a fix released in 11.4.10 and 11.8.6, respectively.
Source: www.csoonline.com
