ZDI-26-974: PostgreSQL pg_stat_statements Extension Heap-based Buffer Overflow Remote Code Execution Vulnerability

Published Nov 13, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PostgreSQL. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-14676.

Event History

Nov 13, 2026

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

Who is realistically exposed to exploitation?

Affected PostgreSQL installations where an attacker can authenticate are exposed. The available information does not specify required privileges beyond authentication or any network-access limitations.

What does an attacker need to exploit this issue?

The attacker must authenticate to the affected PostgreSQL installation. Successful exploitation can result in arbitrary code execution.

How severe is this vulnerability?

ZDI assigned a CVSS rating of 8.8. The issue is tracked as CVE-2026-14676.

ZDI-26-974: PostgreSQL pg_stat_statements Extension Heap-based Buffer Overflow Remote Code Execution Vulnerability

Event History

Frequently Asked Questions

Who is realistically exposed to exploitation?

What does an attacker need to exploit this issue?

How severe is this vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to exploitation?

What does an attacker need to exploit this issue?

How severe is this vulnerability?