CVE-2026-19385

A flaw was found in PostgreSQL pg_dump. A heap buffer overflow vulnerability exists when processing long function transform lists. An authenticated object creator can exploit this by providing a specially crafted transform list. This allows the attacker to execute arbitrary code as the operating system user running pg_dump.

Important: A heap buffer overflow in PostgreSQL pg_dump allows authenticated database users to execute arbitrary code. Attackers with object-creation privileges can use crafted function transform lists to run OS commands as the backup user.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict database user privileges, particularly object creation, to trusted administrators only. Ensure that pg_dump operations are performed by users with the least necessary operating system privileges to limit the impact of potential code execution.