Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongly denies those commands to the prior statistics object owner. DROP TABLE remains able to remove statistics objects, so this exploit achieves nothing in many ownership arrangements. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands. "COPY FROM" with a filename is unaffected. The server administrator has no inherent control over the data rows, so a complete attack requires the attacker to separately acquire control of both the server and the data rows. Alternatively, an attacker controlling data rows alone might complete an attack through a coincidental error that they don't control. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application's pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14671 is a high-severity type confusion vulnerability in the PostgreSQL refint module. It allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. The issue affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. A fix was introduced as part of a non-security bug report that removed the plan cache in the refint module. The vulnerability has a CVSS score of 8.8, indicating a high impact on confidentiality, integrity, and availability.
Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-6470 is a medium severity vulnerability in PostgreSQL affecting versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. It involves missing authorization checks in certain DDL commands related to types, allowing an object creator to cause denial of service by creating dependencies that prevent ALTER and DROP operations on the type. The vulnerability does not impact confidentiality or integrity but can cause availability issues.
CVE-2026-19385 is a heap-based buffer overflow vulnerability in PostgreSQL's pg_dump utility related to handling long function transform lists. This flaw allows an object creator to execute arbitrary code with the privileges of the operating system user running pg_dump by supplying a crafted transform list. Versions prior to PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-18024 is a buffer over-read vulnerability in the PostgreSQL ascii() SQL function. It allows a user with limited privileges to read up to 3 bytes beyond the allocated memory by supplying a crafted text value. This vulnerability affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The issue is similar to a previously fixed vulnerability (CVE-2026-2006) but with less impact. The CVSS score is 4.3, indicating a medium severity level.
CVE-2026-16241 is an integer underflow vulnerability in PostgreSQL's ECPG client. It allows a database server administrator to cause a temporary denial of service by sending a malformed bytea value missing the required prefix. This leads to the client overwriting a large memory region, typically resulting in a segmentation fault. In rare cases, it may cause client-specific integrity issues. The vulnerability affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24.
CVE-2026-16239 is a high-severity type confusion vulnerability in PostgreSQL affecting multiple versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. It involves improper handling of the portal or cursor lifecycle, allowing a user with certain privileges to execute arbitrary code as the operating system user running the database.
CVE-2026-15742 is an integer overflow or wraparound vulnerability in PostgreSQL's fuzzystrmatch extension. It allows a user with database privileges to execute arbitrary code as the operating system user running the database by providing extreme inputs to the levenshtein() or levenshtein_less_equal() SQL functions. This affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24.
CVE-2026-15741 is a high-severity SQL injection vulnerability in PostgreSQL's EXTRACT() deparse functionality. It allows an object owner to execute arbitrary SQL commands with superuser privileges via a malicious object definition. This affects various tools that consume expression deparses, including pg_dump and psql commands like \sf. Versions prior to PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are vulnerable.
CVE-2026-14679 is a stack-based buffer overflow vulnerability in PostgreSQL affecting versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The flaw occurs during argument name matching for OUT parameters, allowing an object creator to write limited bytes (0x0 and 0x1) to the stack. This vulnerability has a high severity score of 8.2 and can lead to denial of service or other impacts on availability. No known exploits are reported in the wild. A fix is implied by the version boundaries but no explicit patch links or vendor advisory content are provided.
CVE-2026-14678 is a buffer over-read vulnerability in the pg_trgm index picksplit function of PostgreSQL. This flaw allows reading past the end of a heap buffer, potentially enabling a table maintainer to infer limited memory values through index split behavior. The vulnerability affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The CVSS score is 4.3, indicating medium severity.
Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14670 is a heap-based buffer overflow vulnerability in the PostgreSQL plperl extension. It allows a function owner to execute arbitrary code as the operating system user running the database by exploiting a crafted function body that returns a tied hash. This vulnerability affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The vulnerability has a high severity with a CVSS score of 8.8.
Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.