SB2026081505 - Multiple vulnerabilities in PostgreSQL

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081505

SB2026081505 - Multiple vulnerabilities in PostgreSQL

Published: August 15, 2026

Security Bulletin ID SB2026081505
CSH Severity
High
Patch available
YES
Number of vulnerabilities 28
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 14% Medium 54% Low 32%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 28 vulnerabilities.


1) Untrusted search path (CVE-ID: CVE-2026-14673)

CWE-ID: CWE-426 - Untrusted Search Path

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary functions with the privileges of expression index owners.

The vulnerability exists due to improper control of search path in amcheck functions when invoking amcheck with a hostile search path. A remote privileged user can set a hostile search path before calling the amcheck function to execute arbitrary functions with the privileges of expression index owners.

Exploitation requires EXECUTE privilege on the amcheck function and affects expression indexes that depend on the search path.


2) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2026-6464)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute psql commands.

The vulnerability exists due to untrusted data inclusion in psql COPY FROM STDIN handling when a COPY FROM STDIN or \\copy FROM STDIN command fails before the server indicates that it awaits input rows. A remote attacker can trigger an early failure so that in-line data rows are processed as psql commands to execute psql commands.

A complete attack requires control of both the server and the data rows, although an attacker controlling only the data rows might succeed if a coincidental error occurs.


3) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-6469)

CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to gain unauthorized control over statistics objects.

The vulnerability exists due to improper ownership assignment in the ALTER TABLE ALTER TYPE command when altering a table column type. A remote privileged user can run ALTER TABLE ALTER TYPE to reassign ownership of dependent statistics objects and gain unauthorized control over statistics objects.

This can allow the table owner to run DROP STATISTICS and ALTER STATISTICS on affected dependent statistics objects, while denying those commands to the prior statistics object owner.


4) Improper Authorization (CVE-ID: CVE-2026-6470)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper access control in PostgreSQL DDL commands when assigning a range subtype or referencing a type from an SQL expression. A remote user can create a dependency on the type to cause a denial of service.

The issue affects ALTER and DROP operations on the type.


5) Improper Authorization (CVE-ID: CVE-2026-6471)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper access control in logical decoding when selecting a logical decoding plugin. A remote privileged user can choose an arbitrary file visible to the server operating system account as a logical decoding plugin to execute arbitrary code.

Exploitation requires the REPLICATION privilege but does not require superuser privileges.


6) Integer overflow (CVE-ID: CVE-2026-14662)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to integer overflow in tsvector and tsquery data type functions when processing crafted large inputs. A remote user can supply crafted large inputs to cause an undersized allocation and write out-of-bounds to execute arbitrary code.

This may execute code as the operating system user running the database.


7) Missing Encryption of Sensitive Data (CVE-ID: CVE-2026-14663)

CWE-ID: CWE-311 - Missing Encryption of Sensitive Data

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose cleartext data and tamper with encrypted data.

The vulnerability exists due to improper encryption in pgcrypto functions when processing OpenSSL-disabled ciphers. A remote attacker can observe faulty ciphertext or supply encrypted input to disclose cleartext data and tamper with encrypted data.

The OpenSSL version and configuration determine which ciphers are disabled, and decryption may succeed even with the wrong key.


8) Heap-based buffer overflow (CVE-ID: CVE-2026-14664)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in PostgreSQL regexp processing when processing text that would not pass encoding validation. A remote user can supply a crafted query containing such text to execute arbitrary code.

Successful exploitation can occur in the context of the operating system user running the database.


9) Missing Authorization (CVE-ID: CVE-2026-14666)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass row-level security restrictions and access or modify data that should no longer be permitted.

The vulnerability exists due to incomplete tracking of role membership, role attribute, and database ownership changes in PostgreSQL row-level security policy caching when reusing query plans. A remote user can reuse a cached plan after privilege or role changes to bypass row-level security restrictions and access or modify data that should no longer be permitted.

Exploitation requires tailoring the attack to an application's pattern of privilege removal and role-specific row security policies, and stale policies persist until cache invalidation or session termination.


10) Type Confusion (CVE-ID: CVE-2026-14668)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and cause a denial of service.

The vulnerability exists due to type confusion in the ctid data type selectivity estimator when processing a chosen non-ctid input. A remote user can create an object with crafted input to disclose sensitive information and cause a denial of service.

The disclosed value is a calculation derived from an arbitrary 4-byte span of memory, and substantial memory value recovery appears possible despite loss of precision.


11) Heap-based buffer overflow (CVE-ID: CVE-2026-14669)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in to_char(timestamptz) when processing a long POSIX timezone abbreviation. A remote user can supply a crafted timezone value to execute arbitrary code.

The code executes as the operating system user running the database.


12) Heap-based buffer overflow (CVE-ID: CVE-2026-14670)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in the PostgreSQL plperl tied hash return handling when processing a crafted function body that returns a tied hash. A remote user can create a crafted function body to execute arbitrary code.

The code executes as the operating system user running the database.


13) Type Confusion (CVE-ID: CVE-2026-14671)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to type confusion in the refint module plan cache when processing object definitions created in the module. A remote user can create a crafted object to execute arbitrary code.

Successful exploitation results in code execution as the operating system user running the database.


14) Observable discrepancy (CVE-ID: CVE-2026-14672)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper information exposure in the SCRAM authentication mechanism when handling authentication requests. A remote attacker can observe the SCRAM iteration count in the authentication challenge to disclose sensitive information.

The issue can be used to test whether a user exists only if the probed user has a non-default scram_iterations count.


15) Heap-based buffer overflow (CVE-ID: CVE-2026-19385)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in pg_dump when processing long function transform lists. A remote user can create a crafted transform list to execute arbitrary code.

Code execution occurs as the operating system user running pg_dump.


16) Heap-based buffer overflow (CVE-ID: CVE-2026-14676)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the pg_stat_statements module when processing crafted queries containing array constants. A remote user can send crafted queries containing array constants to execute arbitrary code.

The code may run as the operating system user running the database.


17) Integer overflow (CVE-ID: CVE-2026-14677)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to integer overflow in pltcl and plperl when processing crafted function bodies on 32-bit builds. A remote user can create a crafted function body to execute arbitrary code.

Only 32-bit builds are vulnerable.


18) Out-of-bounds read (CVE-ID: CVE-2026-14678)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose limited memory values.

The vulnerability exists due to an out-of-bounds read in the pg_trgm index picksplit function when processing index split operations. A remote user can maintain a table to infer limited memory values via the lossy signal of index split choices.


19) Stack-based buffer overflow (CVE-ID: CVE-2026-14679)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service and modify server memory.

The vulnerability exists due to stack-based buffer overflow in PostgreSQL argument name matching when processing crafted OUT parameter counts. A remote attacker can create an object with crafted parameters to cause a denial of service and modify server memory.

The memory write is limited to 0x0 and 0x1 byte values.


20) Type Confusion (CVE-ID: CVE-2026-14680)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to type confusion in functions with "internal" argument types when invoking such functions from SQL. A remote user can call functions with that argument type to execute arbitrary code.

Successful exploitation can run code as the operating system user running the database.


21) Improper access control (CVE-ID: CVE-2026-14681)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to negotiate a connection with lesser protection than required and weaken message integrity protections.

The vulnerability exists due to improper enforcement of message integrity in PostgreSQL GSSAPI support when establishing an initial direct TLS connection. A remote user can negotiate GSSAPI contrary to pg_hba.conf rules to negotiate a connection with lesser protection than required and weaken message integrity protections.

The issue occurs when TLS settings are more permissive than the GSS settings.


22) SQL injection (CVE-ID: CVE-2026-15741)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary SQL as a superuser.

The vulnerability exists due to SQL injection in EXTRACT() expression deparse when processing a hostile object definition. A remote attacker can create a crafted object definition to execute arbitrary SQL as a superuser.

User interaction is required when a victim uses an expression deparse consumer such as pg_dump, psql \sf, or a similar non-core tool.


23) Integer overflow (CVE-ID: CVE-2026-15742)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to integer overflow in the fuzzystrmatch levenshtein() and levenshtein_less_equal() functions when processing extreme SQL inputs. A remote user can supply crafted input values to direct writes to a huge range of addresses and execute arbitrary code.

Code execution occurs as the operating system user running the database.


24) Type Confusion (CVE-ID: CVE-2026-16238)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to type confusion in pg_restore_attribute_stats() when restoring attribute statistics involving conflated range and multirange values. A remote user can create a crafted object to execute arbitrary code.

Code execution occurs as the operating system user running the database.


25) Type Confusion (CVE-ID: CVE-2026-16239)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to type confusion in the portal/cursor lifecycle when re-creating a cursor or other portal with different types. A remote user can re-create a cursor or other portal with different types to execute arbitrary code.

Successful exploitation results in code execution as the operating system user running the database.


26) Integer underflow (CVE-ID: CVE-2026-16241)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to integer underflow in the ECPG client when processing a bytea value lacking the mandatory prefix. A remote privileged user can send a specially crafted bytea value to cause a denial of service.

In rare cases, the overwrite may also cause limited client-specific integrity impact.


27) Out-of-bounds read (CVE-ID: CVE-2026-18024)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the ascii() SQL function when processing a crafted text value. A remote user can supply a crafted text value to disclose sensitive information.

Successful exploitation can disclose up to 3 bytes after the end of a specific allocation.


28) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2026-18408)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper neutralization of special elements in pg_dump and related dump-generation tools when processing untrusted server-side data for restore in psql. A remote attacker can inject arbitrary code into a dump file to execute arbitrary code.

User interaction is required to restore the crafted dump with psql.


Remediation

Install update from vendor's website.

References