CVE-2026-16240

Use of externally-controlled format string in PostgreSQL pgbasebackup allows an attacker having already compromised a server to achieve disclosure from pgbasebackup memory, via backup manifest bytes. The vulnerability does not return the improperly-read bytes back to the attacker's server, so a...