20-Year-Old PostgreSQL Flaw Gets Public PoC Exploit for Remote Code Execution

A public proof-of-concept for CVE-2026-2005 reveals a decades-old heap-based buffer overflow in PostgreSQL's pgcrypto PGP session key parsing that can be chained to leak heap pointers, perform arbitrary memory read/write, escalate to the PostgreSQL superuser, and run OS commands via COPY FROM PROGRAM; while the exploit requires matching build offsets which may limit broad abuse, affected pgcrypto-enabled deployments face high risk and should apply patches, restrict pgcrypto usage, and monitor for exploitation.