Threats Tagged 'cve-2026-14673'

This security update for PostgreSQL 18 addresses multiple vulnerabilities affecting various components such as psql, logical decoding, pgcrypto, regexp, and others. The issues include heap buffer overflows that can lead to arbitrary code execution, type confusion, integer wraparound causing undersize allocations, privilege enforcement failures, and SQL injection risks. The update fixes these vulnerabilities to improve the security and stability of PostgreSQL 18 and related versions.

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including multiple PostgreSQL 17 packages. The update addresses several vulnerabilities identified by CVE-2026-14663 and others. This advisory provides updated RPM packages for various PostgreSQL components across aarch64 and x86_64 architectures. The update is classified as a high severity security advisory and includes bug fixes and enhancements. A patch is available and should be applied to affected systems to mitigate the vulnerabilities.

A vulnerability in PostgreSQL's amcheck extension allows a user with EXECUTE privilege on the amcheck function to execute arbitrary functions as owners of expression indexes by manipulating the search path. This affects PostgreSQL major versions 14, 15, 16, and 18 in specific minor versions before 14.24, 15.19, 16.15, and 18.5 respectively. PostgreSQL 17 is not affected. The issue arises from not clearing an untrusted search path before executing the function.

CVE-2026-14673 is a low-severity vulnerability in PostgreSQL affecting certain minor versions of major releases 14, 15, 16, and 18. It involves an untrusted search path issue in the amcheck extension, where a user with EXECUTE privilege on the amcheck function can execute arbitrary functions as owners of expression indexes by manipulating the search path. PostgreSQL 17 is not affected.