CVE-2026-119923

Summary

A heap-based buffer overflow in the Babelfish TDS prelogin parser allows remote attackers to execute arbitrary OS commands as the database user by sending a malformed TDS prelogin packet to the TDS port (default 1433). This is critical due to the combination of remote exploitability, no authentication requirement, and full system compromise potential.

Exploitability

Exploitation is straightforward for remote attackers with network access to the TDS port; no authentication or user interaction is required.

Blast radius

Successful exploitation grants full control over the database process, enabling data exfiltration, lateral movement, ransomware deployment, and complete compromise of the underlying host and connected systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade Babelfish for PostgreSQL extension to version 4.10, 5.6, or 6.1 or later; for Amazon Aurora PostgreSQL with Babelfish, upgrade to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), or 18.4.1 (6.1.0) or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.