CVE-2026-14676CWE-122

CVE-2026-14676

High · published August 13, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
36.8
In the wild
Unconfirmed
What it is

Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00436 · 36.8th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2026-08-13T17:17Z
Affected products (1)
ProductVersionsFixed in
postgresql/postgresql≥ 18.0, < 18.518.5
References (1)
https://www.postgresql.org/support/security/CVE-2026-14676/ · f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
EPSS history
Timeline
  • 13 AUG 13:00Z
    PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code
    cvelistv5