The update for PostgreSQL 18 fixes numerous vulnerabilities including CVE-2026-6464 where psql's COPY FROM STDIN processes data lines as commands on early failure; CVE-2026-6469 resetting extended statistics ownership improperly; CVE-2026-6470 failing to check type USAGE privilege; CVE-2026-6471 allowing logical decoding to dlopen arbitrary files; and CVE-2026-14662 involving integer wraparound causing undersize allocations in tsvector and tsquery. Other critical fixes include heap buffer overflows in regexp (CVE-2026-14664), to_char (CVE-2026-14669), plperl (CVE-2026-14670), pg_stat_statements (CVE-2026-14676), and pg_dump (CVE-2026-19385) that can lead to arbitrary code execution. Additional vulnerabilities address type confusion, SQL injection via expression deparse, improper GSSAPI encryption enforcement, and user existence oracle via response discrepancies. The update also includes build fixes and LLVM version updates for SUSE Linux Enterprise.

The vulnerabilities fixed in this update can lead to arbitrary code execution, privilege escalation, information disclosure, denial of service, and SQL injection. Several heap buffer overflows and type confusion issues allow attackers to execute arbitrary code on the server. Privilege enforcement failures and user existence oracles can aid attackers in unauthorized access. Integer wraparound bugs may cause memory corruption or incorrect behavior. Overall, these vulnerabilities pose a high security risk to affected PostgreSQL installations.

A patch is available and should be applied promptly to affected PostgreSQL versions to remediate these vulnerabilities. The update to PostgreSQL version 18.6 and corresponding versions for earlier branches addresses all listed issues. No additional mitigations are indicated beyond applying the official update.