CVE-2026-14679 is a stack-based buffer overflow vulnerability in PostgreSQL affecting versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The flaw occurs during argument name matching for OUT parameters, allowing an object creator to write limited bytes (0x0 and 0x1) to the stack. This vulnerability has a high severity score of 8.2 and can lead to denial of service or other impacts on availability. No known exploits are reported in the wild. A fix is implied by the version boundaries but no explicit patch links or vendor advisory content are provided.
CVE-2026-14678 is a buffer over-read vulnerability in the pg_trgm index picksplit function of PostgreSQL. This flaw allows reading past the end of a heap buffer, potentially enabling a table maintainer to infer limited memory values through index split behavior. The vulnerability affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The CVSS score is 4.3, indicating medium severity.
Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14676 is a heap-based buffer overflow vulnerability in PostgreSQL's pg_stat_statements module. It allows a query author to execute arbitrary code with the privileges of the operating system user running the database by submitting crafted queries containing array constants. This affects PostgreSQL major version 18, specifically versions from 18.0 up to but not including 18.6. Versions prior to 18.0 are not affected.
CVE-2026-14673 is a low-severity vulnerability in PostgreSQL affecting certain minor versions of major releases 14, 15, 16, and 18. It involves an untrusted search path issue in the amcheck extension, where a user with EXECUTE privilege on the amcheck function can execute arbitrary functions as owners of expression indexes by manipulating the search path. PostgreSQL 17 is not affected.
CVE-2026-14672 is a medium severity vulnerability in PostgreSQL versions 16 through 18 prior to specific minor releases. It involves an observable response discrepancy in SCRAM authentication that allows unauthenticated users to test for the existence of a database user by observing differences in the SCRAM iteration count. This issue only affects users with non-default scram_iterations settings. Versions before PostgreSQL 16 are not affected.
CVE-2026-14670 is a heap-based buffer overflow vulnerability in the PostgreSQL plperl extension. It allows a function owner to execute arbitrary code as the operating system user running the database by exploiting a crafted function body that returns a tied hash. This vulnerability affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The vulnerability has a high severity with a CVSS score of 8.8.
CVE-2026-14669 is a heap-based buffer overflow vulnerability in PostgreSQL's to_char function for timestamptz data type. It allows an attacker who can control the timezone input to execute arbitrary code with the privileges of the database operating system user by providing a long POSIX timezone abbreviation. This vulnerability affects multiple PostgreSQL major versions prior to specific patch releases.
Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14663 is a vulnerability in PostgreSQL's pgcrypto module where cleartext data can be recovered due to disabled ciphers in OpenSSL. This flaw affects multiple encryption and decryption functions, allowing decryption to succeed even with incorrect keys, thereby bypassing the Modification Detection Code (MDC) protection. Versions prior to PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. The vulnerability has a medium severity with a CVSS score of 6.5.
CVE-2026-14662 is an integer overflow or wraparound vulnerability in PostgreSQL's tsvector and tsquery data type functions. It allows an unprivileged database user to cause the server to undersize memory allocation and write out-of-bounds with crafted large inputs, potentially leading to arbitrary code execution as the operating system user running the database. The vulnerability affects PostgreSQL versions before 18.6, 17.11, 16.15, 15.19, and 14.24. Application users attacking through typical application interfaces are unlikely to exploit this issue because these types are usually sourced from application logic rather than directly from user input. Similar issues were addressed in CVE-2026-6473.
CVE-2026-6638 is a low-severity SQL injection vulnerability in PostgreSQL affecting logical replication commands. Specifically, the ALTER SUBSCRIPTION ... REFRESH PUBLICATION command allows a subscriber table creator to execute arbitrary SQL using the publication-side credentials. This vulnerability impacts PostgreSQL major versions 16, 17, and 18, but only in minor versions before 16.14, 17.10, and 18.4. Versions prior to 16 are not affected. The attack executes at the next REFRESH PUBLICATION operation. No known exploits are reported in the wild, and no official patch or remediation level has been provided yet.
CVE-2026-6575 is a medium-severity buffer over-read vulnerability in PostgreSQL version 18 prior to 18.4. The issue occurs in the pg_restore_attribute_stats() function, which improperly handles array values of unmatched length, causing query planning to read beyond the end of an array. This flaw allows a table maintainer to infer memory contents beyond the intended array boundary. Versions before PostgreSQL 18 are not affected. No official patch or remediation details are currently provided.
CVE-2026-6476 is a high-severity SQL injection vulnerability in PostgreSQL affecting versions 17 and 18 prior to 17.10 and 18.4, respectively. It allows an attacker with pg_create_subscription rights to execute arbitrary SQL commands with superuser privileges when the pg_createsubscriber function runs. Versions before PostgreSQL 17 are not affected. There is no confirmed patch or official remediation information available at this time.
CVE-2026-6474 is a medium severity vulnerability in PostgreSQL affecting versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23. It involves an externally-controlled format string in the timeofday() function that allows an attacker to retrieve portions of server memory by using crafted timezone zones. The vulnerability has a CVSS score of 4.3 and does not require user interaction but does require low privileges. No known exploits are reported in the wild.
CVE-2026-6637 is a high-severity stack-based buffer overflow vulnerability in the PostgreSQL database module "refint". It allows an unprivileged database user to execute arbitrary code with the privileges of the operating system user running the database. Additionally, if a user-controlled column is declared as a "refint" cascade primary key and user-controlled updates to that column are allowed, a SQL injection can enable arbitrary SQL execution as the database user. This vulnerability affects PostgreSQL versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23. No official patch or remediation details are currently provided.
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
CVE-2026-6475 is a high-severity vulnerability in PostgreSQL affecting versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23. It involves symbolic link (symlink) following in the pg_basebackup plain format and pg_rewind utilities, allowing an origin superuser to overwrite local files such as /var/lib/postgres/. bashrc. This can lead to hijacking the operating system account if relevant actions are taken between these commands and server restart. The vulnerability relies on the implicit trust of the origin superuser when starting the server, especially with features like shared_preload_libraries.
Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.