CVEvulnerability

CVE-2026-14676

8.8 HIGH Published 2026-08-13 Modified 2026-08-29 Official page ↗
Status
Modified
Published
2026-08-13
Last modified
2026-08-29
Assigner
f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
CVSS 3.1 (f86ef6dc-4d3a-42ad-8f28-e6d5547a5007)
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-122

Description

Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

Affected configurations

• postgresql postgresql (>= 18.0 < 18.5)

Related

Weakness · CWE (1)

  • CWE-122 Heap-based Buffer Overflow weakness

References