Stack Buffer Overflow in PostgreSQL 'refint' Module Affects Database Functionality

CVE-2026-6637

What is CVE-2026-6637?

A stack buffer overflow vulnerability exists in the 'refint' module of PostgreSQL, which can be exploited by an unprivileged database user. If a user-controlled column is declared as a 'refint' cascade primary key, and updates to that column are allowed, an attacker may leverage a SQL injection to execute arbitrary SQL commands as the database user. This vulnerability poses a significant risk, enabling unauthorized code execution in the context of the operating system user running the database. Users are advised to upgrade to PostgreSQL versions 18.4, 17.10, 16.14, 15.18, and 14.23 or later to mitigate potential exploitation.

References