CVE-2019-10128

CVE-2019-10128 is a local privilege escalation vulnerability affecting PostgreSQL versions 11.x prior to 11.3, specifically when installed on Windows using the EnterpriseDB installer. The installer fails to properly secure the access control lists (ACLs) for the binary and data directories. This allows a local attacker to read sensitive data directory files, bypassing database access controls, and in certain configurations, execute arbitrary code as the PostgreSQL service account. The vulnerability has a CVSSv3 score of 7.8 (High) due to its low attack complexity and high impact on confidentiality, integrity, and availability. There is no known active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.