PostgreSQL and PgBouncer Flaws Expose Servers to Buffer Overflow and SQL Injection

Microsoft disclosed two high-severity database-related vulnerabilities affecting PgBouncer and PostgreSQL, including CVE-2026-6665, a stack-based buffer overflow in PgBouncer's SCRAM authentication handling, and CVE-2026-6637, which affects PostgreSQL's refint component and can allow both a stack buffer overflow and SQL injection. The PgBouncer issue is classified as CWE-121 and carries a CVSS 8.1 score, indicating high potential impact to confidentiality, integrity, and availability.

According to Microsoft's advisory, CVE-2026-6665 is remotely reachable over the network, requires no privileges and no user interaction, though exploitation is assessed as having high attack complexity. The related PostgreSQL refint flaw broadens the risk profile by combining memory corruption with SQL injection exposure, raising concern for organizations running PostgreSQL environments directly or behind PgBouncer connection pooling layers.