Heap-based buffer overflow in PostgreSQL - CVE-2026-14676
Published: August 15, 2026
Vulnerability identifier: #VU142632
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-14676
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to a heap-based buffer overflow in the pg_stat_statements module when processing crafted queries containing array constants. A remote user can send crafted queries containing array constants to execute arbitrary code.
The code may run as the operating system user running the database.
Affected software
PostgreSQL
How to mitigate CVE-2026-14676
Install security update from vendor's website.
PostgreSQL - update to 18.5