The vulnerability CVE-2026-6477 involves the use of the PQfn function in PostgreSQL's libpq client library, which does not properly limit the size of data copied into a client stack buffer. This buffer overflow occurs in functions lo_export(), lo_read(), lo_lseek64(), and lo_tell64(), enabling a PostgreSQL server superuser to overwrite client stack memory arbitrarily. Because the \lo_export command in psql and pg_dump invoke lo_read(), these client tools are susceptible to stack memory corruption. The issue affects PostgreSQL versions before 18.4, 17.10, 16.14, 15.18, and 14.23. Red Hat has published multiple security advisories and errata providing patches for affected Red Hat Enterprise Linux versions, including postgresql16-16.14-1.el10_0 and related packages.

Successful exploitation allows a PostgreSQL server superuser to overwrite client stack memory in applications using libpq functions such as psql and pg_dump. This can lead to client application crashes, memory corruption, and potentially arbitrary code execution on the client side. The vulnerability has a CVSS 3.1 score of 8.8 (high severity) with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Red Hat has released security updates for affected PostgreSQL packages (e.g., postgresql16-16.14-1.el10_0) that address this vulnerability. Users should apply these official patches promptly to remediate the issue. The vendor advisory URLs provided by Red Hat contain detailed instructions for updating affected systems. Since this is a client-side buffer overflow triggered by server responses, updating client packages is essential. Patch status is confirmed by Red Hat advisories; therefore, applying these updates is the recommended mitigation.