CVE-2026-14664·PostgreSQL vulnerability
Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
- Severity
- high
- Software
- PostgreSQL
- Fixed in
- 18.5
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.44% — higher than 36% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Read the two together. CVE-2026-14664 scores 8.8 on CVSS, so a successful attack would be serious — but at 0.44%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.
Affected versions
From: 18.0
Until: 18.5
Fixed in: 18.5
How to fix this CVE
PostgreSQL users running versions 18.0 through 18.5 must upgrade to PostgreSQL 18.6 or later to address a critical heap buffer overflow in the regular expression engine. This vulnerability can allow authenticated database users to execute arbitrary code with the privileges of the PostgreSQL system user. Prioritize this update immediately, especially for production environments handling untrusted regex patterns.
sudo dnf update postgresql-server postgresql-contrib postgresql-libsDefensia detects this vulnerability
How to check if you are affected
- Check installed PostgreSQL version: psql --version or SELECT version(); from within psql
- Determine if regex functions are in use: Query pg_proc system catalog for 'regexp' or '~' operators in user-defined functions or stored procedures
- Review PostgreSQL logs for errors related to regex processing: grep -i 'regex\|regexp\|buffer\|overflow' /var/log/postgresql/*.log or system journal logs
- Verify the patch was applied: Compare psql --version output against 18.6 or later; confirm via SELECT pg_postmaster_process_location();
FAQ
What is CVE-2026-14664?
A heap buffer overflow in PostgreSQL's regular expression engine that occurs during character encoding round-trip processing through pg_wchar. An authenticated attacker can exploit this by submitting specially crafted regex patterns to execute arbitrary code as the database system user.
Is CVE-2026-14664 being actively exploited?
According to CISA, CVE-2026-14664 is not currently listed in the Known Exploited Vulnerabilities catalog, and no public exploits are available. However, the vulnerability requires only low privilege (authenticated user) to trigger, so patching should not be delayed.
What versions of PostgreSQL are affected by CVE-2026-14664?
PostgreSQL versions 18.0 through 18.5 are vulnerable. Earlier major versions (17.x, 16.x, 15.x, 14.x) have corresponding vulnerable ranges; verify your specific version against the PostgreSQL security advisory.
How do I check if my server is vulnerable to CVE-2026-14664?
Run 'psql --version' or execute 'SELECT version();' inside a psql connection. If the version is 18.0, 18.1, 18.2, 18.3, 18.4, or 18.5, your server is vulnerable and requires immediate patching to 18.6 or later.
Does Defensia detect CVE-2026-14664?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-14664 will appear in your dashboard with remediation steps.
Related PostgreSQL CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-14664. Free for 1 server.
Get started free