Stack Buffer Overflow in PostgreSQL Affects Multiple Versions
CVE-2026-14679

8.2HIGH

Key Information:

Vendor

PostgreSQL
Status
Postgresql
Vendor
CVE Published:
13 August 2026

What is CVE-2026-14679?

A stack buffer overflow vulnerability exists in PostgreSQL that arises from improper parameter name matching. This flaw allows an object creator to potentially create adverse impacts through the manipulation of OUT parameter counts, which could potentially lead to unauthorized access or manipulation of data. The attack vector is limited to writing specific byte values (0x0 and 0x1). Users are advised to upgrade to fixed versions to mitigate potential vulnerabilities.

Affected Version(s)

PostgreSQL 18 < 18.5

PostgreSQL 17 < 17.11

PostgreSQL 16 < 16.15

References

https://www.postgresql.org/support/security/CVE-2026-14679/

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL project thanks Zheng Yu (DepthFirst AI) and ylwangtju for reporting this problem.
.