8.8
High
CVE-2026-6477 Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(),…
Description
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| postgresql 18 | 18 → < 18.4 | 18.4 |
| postgresql 17 | 17 → < 17.10 | 17.10 |
| postgresql 16 | 16 → < 16.14 | 16.14 |
| postgresql 15 | 15 → < 15.18 | 15.18 |
| postgresql 14.23 | earliest → < 14.23 | 14.23 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 10) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 8) | Versions not published | |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Versions not published |
Show the 33 other branches Hide the 33 other branches
References
- www.postgresql.org www.postgresql.org
Timeline
- Published
- Last modified
Other CVEs of postgresql
The 79 CVEs of postgresql →
CVE-2026-6471
Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen…
7.2
High
CVE-2026-14671
Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating…
8.8
High
CVE-2026-6470
Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and…
4.3
Medium
CVE-2026-6464
Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as…
8.1
High