REDHAT-BUG-2515324: Buffer Overflow

Q: Which deployments are affected?

Only PostgreSQL major version 18 installations with pg_stat_statements are affected when running a minor version earlier than 18.5. PostgreSQL versions before 18 are unaffected.

Q: What access does an attacker need to exploit this issue?

The attacker must be able to author and execute crafted SQL queries containing array constants. Successful exploitation can execute arbitrary code as the operating system user that runs the database.

Q: What is the impact of successful exploitation?

A heap buffer overflow in pg_stat_statements can allow the query author to run arbitrary code with the privileges of the database server's operating system account.

Published Aug 13, 2026

Updated

Heap buffer overflow in PostgreSQL pgstatstatements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before PostgreSQL 18 are unaffected.

Affected Software

1 affected component

PostgreSQL pg_stat_statements>=18.0<18.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 18.5

Event History

Aug 13, 2026

Data Sourced

via Red Hat·01:30 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are affected?

Only PostgreSQL major version 18 installations with pg_stat_statements are affected when running a minor version earlier than 18.5. PostgreSQL versions before 18 are unaffected.

What access does an attacker need to exploit this issue?

The attacker must be able to author and execute crafted SQL queries containing array constants. Successful exploitation can execute arbitrary code as the operating system user that runs the database.

What is the impact of successful exploitation?

A heap buffer overflow in pg_stat_statements can allow the query author to run arbitrary code with the privileges of the database server's operating system account.

REDHAT-BUG-2515324: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What is the impact of successful exploitation?