PostgreSQL CVEs from February 2026 release — pgcrypto heap overflow, intarray code exec, pg_trgm privilege escalation

PostgreSQL 18.3, 17.9, 16.13, 15.17, and 14.22 were released on 2026-02-26 patching four critical CVEs: CVE-2026-2005 (pgcrypto heap buffer overflow → arbitrary code exec), CVE-2026-2004 (intarray selectivity estimator missing type validation → arbitrary code exec), CVE-2026-2003 (oidvector memory disclosure), CVE-2026-2007 (pg_trgm heap buffer overflow → privilege escalation). ODS runs PostgreSQL 17 — the patched version is 17.9. Current production is likely still on 17.7 or earlier if not upgraded after the February release.