CVE-2026-14676: Heap-based Buffer Overflow in PostgreSQL
CVE-2026-14676 is a heap-based buffer overflow vulnerability in PostgreSQL's pg_stat_statements module. It allows a query author to execute arbitrary code with the privileges of the operating system user running the database by submitting crafted queries containing array constants. This affects PostgreSQL major version 18, specifically versions from 18.0 up to but not including 18.6. Versions prior to 18.0 are not affected.
AI Analysis
Technical Summary
This vulnerability is a heap buffer overflow in the pg_stat_statements extension of PostgreSQL, which can be triggered by a query author submitting specially crafted queries with array constants. Successful exploitation enables arbitrary code execution as the OS user running the database process. The issue affects PostgreSQL versions starting from 18.0 up to but excluding 18.6 within major version 18. Versions before 18.0 are not vulnerable.
Potential Impact
An attacker with query author privileges can exploit this vulnerability to execute arbitrary code with the operating system privileges of the database user. This can lead to full compromise of the database server under that user context, including confidentiality, integrity, and availability impacts.
Mitigation Recommendations
A fix is available in PostgreSQL version 18.6. Users should upgrade to version 18.6 or later to remediate this vulnerability. Versions prior to 18.0 are not affected. No additional mitigation steps are indicated beyond applying the official patch.
CVE-2026-14676: Heap-based Buffer Overflow in PostgreSQL
Description
CVE-2026-14676 is a heap-based buffer overflow vulnerability in PostgreSQL's pg_stat_statements module. It allows a query author to execute arbitrary code with the privileges of the operating system user running the database by submitting crafted queries containing array constants. This affects PostgreSQL major version 18, specifically versions from 18.0 up to but not including 18.6. Versions prior to 18.0 are not affected.
CVSS v3.1
Score 8.8high
Affected software
PostgreSQL
pkg:deb/postgresql/postgresqlRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability is a heap buffer overflow in the pg_stat_statements extension of PostgreSQL, which can be triggered by a query author submitting specially crafted queries with array constants. Successful exploitation enables arbitrary code execution as the OS user running the database process. The issue affects PostgreSQL versions starting from 18.0 up to but excluding 18.6 within major version 18. Versions before 18.0 are not vulnerable.
Potential Impact
An attacker with query author privileges can exploit this vulnerability to execute arbitrary code with the operating system privileges of the database user. This can lead to full compromise of the database server under that user context, including confidentiality, integrity, and availability impacts.
Mitigation Recommendations
A fix is available in PostgreSQL version 18.6. Users should upgrade to version 18.6 or later to remediate this vulnerability. Versions prior to 18.0 are not affected. No additional mitigation steps are indicated beyond applying the official patch.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- PostgreSQL
- Date Reserved
- 2026-07-03T20:28:16.168Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a7dc617bf8831d5393e53a1
Added to database: 08/13/2026, 13:26:47 UTC
Last enriched: 09/12/2026, 04:46:48 UTC
Last updated: 09/28/2026, 17:01:35 UTC
Views: 44
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.