CVE-2026-18024

A flaw was found in PostgreSQL. A buffer over-read vulnerability in the ascii() SQL function allows a user to disclose up to 3 bytes of memory after the end of a specific allocation by providing a specially crafted text value. This could lead to limited information disclosure.

This Moderate impact information disclosure flaw in PostgreSQL's ascii() SQL function allows an authenticated attacker to read up to 3 bytes of memory beyond an allocated buffer by providing a specially crafted text value. The limited scope of data disclosure contributes to its Moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this allow only trusted roles to run arbitrary SQL, and do not let untrusted users call ascii() on values they supply. Use a UTF-8 database encoding so the server rejects invalid multibyte input at the protocol boundary where possible, and restrict database network access to trusted clients.