CVE-2026-14676: PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code
Heap buffer overflow in PostgreSQL pgstatstatements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQL pg_stat_statementsto a version that resolves this vulnerability.Fixed in 18.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14676?
CVE-2026-14676 has a severity rating of 8.8, classified as high.
How do I fix CVE-2026-14676?
To fix CVE-2026-14676, upgrade PostgreSQL pg_stat_statements to version 18.5 or later.
What types of systems are affected by CVE-2026-14676?
CVE-2026-14676 affects PostgreSQL major version 18, minor versions before 18.5.
What could attackers achieve by exploiting CVE-2026-14676?
Exploitation of CVE-2026-14676 allows attackers to execute arbitrary code as the operating system user running the PostgreSQL database.
What impact does CVE-2026-14676 have on data security?
CVE-2026-14676 can result in unauthorized data access and potential breaches due to its heap buffer overflow vulnerability.