Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. (CVE-2026-14679)
A stack buffer overflow vulnerability exists in PostgreSQL's argument name matching, which allows an object creator to cause impacts by manipulating the OUT parameter count. The vulnerability affects PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24. The attack can write only 0x0 and 0x1 bytes. The CVSS score is 8.2, indicating a high severity issue.
AI Analysis
Technical Summary
CVE-2026-14679 is a stack buffer overflow vulnerability in PostgreSQL related to argument name matching. This flaw allows an object creator to achieve impacts of unknown nature by exploiting the OUT parameter count. The vulnerability permits writing only 0x0 and 0x1 bytes to the stack buffer. It affects PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, and 14.24. The CVSS 3.1 score is 8.2 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.
Potential Impact
An attacker who can create objects in PostgreSQL can exploit this vulnerability to cause a stack buffer overflow, potentially leading to denial of service or other impacts affecting availability. The exact impact beyond availability is unknown. There is no confidentiality impact, and integrity impact is low according to the CVSS vector.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Users should monitor PostgreSQL vendor advisories for updates addressing this vulnerability.
Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. (CVE-2026-14679)
Description
A stack buffer overflow vulnerability exists in PostgreSQL's argument name matching, which allows an object creator to cause impacts by manipulating the OUT parameter count. The vulnerability affects PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24. The attack can write only 0x0 and 0x1 bytes. The CVSS score is 8.2, indicating a high severity issue.
CVSS v3.1
Score 8.2high
Affected software
pkg:deb/postgresql/postgresqlRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-14679 is a stack buffer overflow vulnerability in PostgreSQL related to argument name matching. This flaw allows an object creator to achieve impacts of unknown nature by exploiting the OUT parameter count. The vulnerability permits writing only 0x0 and 0x1 bytes to the stack buffer. It affects PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, and 14.24. The CVSS 3.1 score is 8.2 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.
Potential Impact
An attacker who can create objects in PostgreSQL can exploit this vulnerability to cause a stack buffer overflow, potentially leading to denial of service or other impacts affecting availability. The exact impact beyond availability is unknown. There is no confidentiality impact, and integrity impact is low according to the CVSS vector.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Users should monitor PostgreSQL vendor advisories for updates addressing this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-mpj9-cx22-xp87
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-14679"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a7e0366bf8831d5398f869d
Added to database: 08/13/2026, 17:48:22 UTC
Last enriched: 08/13/2026, 22:41:07 UTC
Last updated: 08/14/2026, 03:40:59 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.