Buffer Overflow Vulnerability in PostgreSQL Affects Server Superuser Access
CVE-2026-6477

8.8HIGH

Key Information:

Vendor

PostgreSQL
Status
Postgresql
Vendor
CVE Published:
14 May 2026

What is CVE-2026-6477?

The PostgreSQL libpq module contains a vulnerability that allows a server superuser to execute potentially harmful functions such as lo_export, lo_read, lo_lseek64, and lo_tell64. This flaw enables an arbitrary buffer overflow, as the PQfn function accepts server-determined data with an undefined size, leading to the ability to overwrite client stack memory. Critical versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23 are directly impacted, posing significant risks for database integrity and security.

Affected Version(s)

PostgreSQL 18 < 18.4

PostgreSQL 17 < 17.10

PostgreSQL 16 < 16.14

References

https://www.postgresql.org/support/security/CVE-2026-6477/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL project thanks Yu Kunpeng and Martin Heistermann for reporting this problem.
.