Wiz ZeroDay.Cloud Event Reveals 20-Year-Old PostgreSQL Vulnerabilities

Wiz researchers disclosed two critical pgcrypto vulnerabilities in PostgreSQL (CVE-2026-2005 and CVE-2026-2006) that enable heap buffer overflows and memory corruption during PGP public-key and symmetric decryption, potentially allowing attackers with minimal privileges to escalate to database-owner execution; a separate MariaDB JSON schema overflow (CVE-2026-32710) was also reported. PostgreSQL and MariaDB published patches across supported branches; administrators are advised to update immediately, restrict extension creation, and audit for suspicious activity.