Heap Buffer Overflow in PostgreSQL Plperl Affects Database Function Execution
CVE-2026-14670

8.8HIGH

Key Information:

Vendor

PostgreSQL
Status
Postgresql
Vendor
CVE Published:
13 August 2026

What is CVE-2026-14670?

A heap buffer overflow vulnerability exists in the plperl interface of PostgreSQL, allowing function owners to execute arbitrary code. This issue arises from inadequate validation when returning a tied hash, enabling malicious users to exploit the system. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are impacted. It is crucial to update your PostgreSQL installation to mitigate potential risks associated with this vulnerability.

Affected Version(s)

PostgreSQL 18 < 18.5

PostgreSQL 17 < 17.11

PostgreSQL 16 < 16.15

References

https://www.postgresql.org/support/security/CVE-2026-14670/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL project thanks Hcamael for reporting this problem.
.