SB2026092221 - Red Hat Enterprise Linux 8 update for the postgresql:12 module
Published: September 22, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 14 vulnerabilities.
1) Integer overflow (CVE-ID: CVE-2026-14662)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to integer overflow in tsvector and tsquery data type functions when processing crafted large inputs. A remote user can supply crafted large inputs to cause an undersized allocation and write out-of-bounds to execute arbitrary code.
This may execute code as the operating system user running the database.
CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute psql commands.
The vulnerability exists due to untrusted data inclusion in psql COPY FROM STDIN handling when a COPY FROM STDIN or \copy FROM STDIN command fails before the server indicates that it awaits input rows. A remote attacker can trigger an early failure so that in-line data rows are processed as psql commands to execute psql commands.
A complete attack requires control of both the server and the data rows, although an attacker controlling only the data rows might succeed if a coincidental error occurs.
3) Improper Authorization (CVE-ID: CVE-2026-6471)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper access control in logical decoding when selecting a logical decoding plugin. A remote privileged user can choose an arbitrary file visible to the server operating system account as a logical decoding plugin to execute arbitrary code.
Exploitation requires the REPLICATION privilege but does not require superuser privileges.
4) Type Confusion (CVE-ID: CVE-2026-14680)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to type confusion in functions with "internal" argument types when invoking such functions from SQL. A remote user can call functions with that argument type to execute arbitrary code.
Successful exploitation can run code as the operating system user running the database.
5) Heap-based buffer overflow (CVE-ID: CVE-2026-14664)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in PostgreSQL regexp processing when processing text that would not pass encoding validation. A remote user can supply a crafted query containing such text to execute arbitrary code.
Successful exploitation can occur in the context of the operating system user running the database.
6) Integer overflow (CVE-ID: CVE-2026-14677)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to integer overflow in pltcl and plperl when processing crafted function bodies on 32-bit builds. A remote user can create a crafted function body to execute arbitrary code.
Only 32-bit builds are vulnerable.
7) Integer overflow (CVE-ID: CVE-2026-15742)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to integer overflow in the fuzzystrmatch levenshtein() and levenshtein_less_equal() functions when processing extreme SQL inputs. A remote user can supply crafted input values to direct writes to a huge range of addresses and execute arbitrary code.
Code execution occurs as the operating system user running the database.
8) Type Confusion (CVE-ID: CVE-2026-16239)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to type confusion in the portal/cursor lifecycle when re-creating a cursor or other portal with different types. A remote user can re-create a cursor or other portal with different types to execute arbitrary code.
Successful exploitation results in code execution as the operating system user running the database.
9) Heap-based buffer overflow (CVE-ID: CVE-2026-14669)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in to_char(timestamptz) when processing a long POSIX timezone abbreviation. A remote user can supply a crafted timezone value to execute arbitrary code.
The code executes as the operating system user running the database.
10) Stack-based buffer overflow (CVE-ID: CVE-2026-14679)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and modify server memory.
The vulnerability exists due to stack-based buffer overflow in PostgreSQL argument name matching when processing crafted OUT parameter counts. A remote attacker can create an object with crafted parameters to cause a denial of service and modify server memory.
The memory write is limited to 0x0 and 0x1 byte values.
11) Type Confusion (CVE-ID: CVE-2026-14671)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to type confusion in the refint module plan cache when processing object definitions created in the module. A remote user can create a crafted object to execute arbitrary code.
Successful exploitation results in code execution as the operating system user running the database.
12) Heap-based buffer overflow (CVE-ID: CVE-2026-14670)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in the PostgreSQL plperl tied hash return handling when processing a crafted function body that returns a tied hash. A remote user can create a crafted function body to execute arbitrary code.
The code executes as the operating system user running the database.
13) Type Confusion (CVE-ID: CVE-2026-14668)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information and cause a denial of service.
The vulnerability exists due to type confusion in the ctid data type selectivity estimator when processing a chosen non-ctid input. A remote user can create an object with crafted input to disclose sensitive information and cause a denial of service.
The disclosed value is a calculation derived from an arbitrary 4-byte span of memory, and substantial memory value recovery appears possible despite loss of precision.
14) Heap-based buffer overflow (CVE-ID: CVE-2026-19385)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in pg_dump when processing long function transform lists. A remote user can create a crafted transform list to execute arbitrary code.
Code execution occurs as the operating system user running pg_dump.
Remediation
Install update from vendor's website.