This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-19385 →

DEBIAN-CVE-2026-19385

Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system...

Original description

The description as published by the source.

Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 postgresql-15

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.19-0+deb12u1"}]}]

Debian:13 postgresql-17

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.11-0+deb13u1"}]}]

Debian:14 postgresql-18

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1"}]}]

References

advisory security-tracker.debian.org