CVE-2026-14680: PostgreSQL type confusion via "internal" arguments
Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.6 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.11 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.15 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.19 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.24
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14680?
The severity of CVE-2026-14680 is high, rated at 8.8.
How do I fix CVE-2026-14680?
To fix CVE-2026-14680, it is recommended to update PostgreSQL to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-14680?
CVE-2026-14680 is a type confusion vulnerability found in PostgreSQL.
What can attackers do with CVE-2026-14680?
Attackers exploiting CVE-2026-14680 can execute arbitrary code as the operating system user running the PostgreSQL database.
Which software is affected by CVE-2026-14680?
CVE-2026-14680 affects PostgreSQL versions that utilize the 'internal' data type arguments.