NCCapital

AI-assisted security research has uncovered serious vulnerabilities in two of the world’s most widely used open-source databases: PostgreSQL and MariaDB. The flaws include multiple buffer overflow issues that could allow attackers to execute arbitrary code on affected database servers. Some of the vulnerable code reportedly dates back more than 20 years, showing how long memory-safety bugs can remain hidden inside trusted infrastructure. The discoveries were made during Wiz’s zeroday.cloud hacking event, where researchers used AI-powered analysis tools to inspect mature database codebases. The event surfaced vulnerabilities in PostgreSQL’s pgcrypto extension, PostgreSQL text handling, and MariaDB’s JSON schema validation logic. The most notable PostgreSQL flaw is CVE-2026-2005, a heap buffer overflow in the pgcrypto extension. PostgreSQL’s security advisory says the bug can allow a ciphertext provider to execute arbitrary code as the operating system user running the database. Affected versions include PostgreSQL releases before 18.2, 17.8, 16.12, 15.16, and 14.21. A second PostgreSQL vulnerability, CVE-2026-2006, involves missing validation of multibyte character length in text manipulation. PostgreSQL says a database user can issue crafted queries that cause a buffer overrun, which is enough to execute arbitrary code as the operating system user running the database. This flaw was also patched in PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21. MariaDB was also affected. CVE-2026-32710 is a heap buffer overflow in the JSON_SCHEMA_VALID() function. NVD says an authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6, and that under certain conditions the crash may be turned into remote code execution. The issue is fixed in MariaDB 11.4.10, 11.8.6, and 12.2.2. The PostgreSQL vulnerabilities are especially serious because they can lead to arbitrary code execution under the database server’s operating system account. In practical terms, that means a successful attacker could potentially move beyond normal SQL access and run code directly on the server, depending on the environment and permissions. The MariaDB flaw appears harder to exploit for full code execution. NVD notes that turning the crash into remote code execution requires tight control over memory layout, which is generally only realistic in lab conditions. Still, any bug that lets an authenticated user crash a production database server is a serious operational risk. The bigger story is not just that these bugs existed. It is that AI-assisted tools helped find vulnerabilities in code that has been reviewed, maintained, and trusted for decades. That does not mean AI automatically replaces human security research, but it does show that AI can help researchers search large codebases for subtle patterns that might otherwise go unnoticed. For administrators, the response is straightforward: patch now. PostgreSQL users should upgrade to 18.2, 17.8, 16.12, 15.16, or 14.21 depending on their major version. MariaDB users should upgrade to 11.4.10, 11.8.6, or 12.2.2. Teams should also review whether database servers are directly exposed to the internet, restrict access to trusted networks, and audit accounts that can run functions involving encryption, text manipulation, or JSON schema validation. These vulnerabilities are a reminder that old code is not automatically safe code. PostgreSQL and MariaDB remain trusted database platforms, but even mature open-source projects can carry long-lived memory bugs. As AI-assisted auditing becomes more common, more hidden flaws in foundational software may come to light. For security teams, the takeaway is clear: patching database engines cannot be treated as routine maintenance only. When flaws involve remote code execution, database updates become infrastructure security priorities.