Heap Buffer Overflow Vulnerability in PostgreSQL Database Software
CVE-2026-14664

8.8HIGH

Key Information:

Vendor

PostgreSQL
Status
Postgresql
Vendor
CVE Published:
13 August 2026

What is CVE-2026-14664?

A heap buffer overflow vulnerability found in PostgreSQL’s regular expression processing allows attackers to execute arbitrary code with the privileges of the operating system user running the database. This issue arises from unexpected data growth when certain inputs are processed, leading to potential security breaches. This vulnerability affects multiple versions of PostgreSQL prior to the specified updates, highlighting the importance of regular software maintenance and security reviews.

Affected Version(s)

PostgreSQL 18 < 18.5

PostgreSQL 17 < 17.11

PostgreSQL 16 < 16.15

References

https://www.postgresql.org/support/security/CVE-2026-14664/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL project thanks Francesco Verardi for reporting this problem.
.