Heap Buffer Overflow in PostgreSQL pgcrypto

This repository is a real Python proof-of-concept exploit for CVE-2026-2005, a heap-based buffer overflow in PostgreSQL's pgcrypto extension during PGP session key parsing. The repo is small and focused: README.md documents the vulnerability and exploitation stages, poc.py contains the full exploit logic, and requirements.txt lists dependencies (psycopg2-binary, pwntools, pycryptodome). The exploit is not part of a larger framework. Its main entry point is poc.py, which connects to a PostgreSQL server using supplied credentials and crafts malicious OpenPGP data to trigger the overflow. Based on the README and visible code, the exploit performs a multi-stage chain: generate RSA material and PGP packets, trigger a heap corruption to leak a heap pointer, use a second corruption to obtain an arbitrary read primitive, scan leaked memory for candidate code pointers, compute/vote on possible PIE bases using symbol offsets from a locally supplied postgres ELF binary, validate the recovered base by reading CurrentUserId, then build an arbitrary write primitive that overwrites CurrentUserId with bootstrap superuser OID 10. Once elevated, it executes an arbitrary OS command through PostgreSQL COPY FROM PROGRAM and prints the output. Operationally, this is more than a simple crash PoC: it includes end-to-end exploitation and post-exploitation command execution, but the payload is still basic and operator-supplied rather than modular, so OPERATIONAL is the best fit. The exploit requires a matching vulnerable PostgreSQL build, pgcrypto enabled, valid DB connectivity, and likely an AArch64 target/build environment due to the explicit pwntools architecture setting. Fingerprintable targets/endpoints are primarily the PostgreSQL host/port and the local postgres binary path used for symbol resolution; there are no hardcoded C2 endpoints or exfiltration destinations.