The vulnerability CVE-2026-6637 involves a stack buffer overflow in the PostgreSQL "refint" module. This flaw permits an unprivileged database user to execute arbitrary code at the OS level under the database service account. A related attack vector exists when a user-controlled column is defined as a "refint" cascade primary key with user-controlled updates, enabling SQL injection and arbitrary SQL execution as the database user. Affected versions include all PostgreSQL releases before 18.4, 17.10, 16.14, 15.18, and 14.23. The CVSS v3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an unprivileged database user to execute arbitrary code with the privileges of the operating system user running PostgreSQL, potentially leading to full system compromise. The SQL injection variant can lead to arbitrary SQL execution as the database user, which may result in unauthorized data access or modification. The vulnerability impacts confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict database user privileges to the minimum necessary and avoid using user-controlled columns as "refint" cascade primary keys with user-controlled updates. Monitor PostgreSQL vendor communications for updates and apply patches promptly once available.