Out-of-Bounds Read Vulnerability in pglogical for PostgreSQL by EDB

CVE-2026-50735

What is CVE-2026-50735?

The pglogical replication system from EDB contains a vulnerability wherein its apply worker performs insufficient validation on the length of specific fields in incoming replication protocol messages. This flaw can lead to an out-of-bounds read, where malicious actors, particularly those controlling a non-PostgreSQL endpoint, can craft messages that exploit the issue. Such crafted messages may cause the apply worker to access memory beyond its allocated buffer, resulting in potential disclosure of adjacent memory or crashing of the worker. The threat is particularly pertinent to managed deployments where subscription privileges are assigned to non-superuser roles.

References