high CVSS 8.1 EPSS 0.33%

CVE-2026-14668·PostgreSQL vulnerability

Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity
high
Software
PostgreSQL
Fixed in
18.5
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.33% — higher than 24% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-14668 scores 8.1 on CVSS, so a successful attack would be serious — but at 0.33%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

From: 18.0

Until: 18.5

Fixed in: 18.5

How to fix this CVE

Organizations running PostgreSQL 18.0 through 18.5 should immediately upgrade to version 18.6 or later to close a type confusion vulnerability in the ctid selectivity estimator. This flaw allows authenticated users to extract sensitive memory contents by providing specially crafted non-ctid inputs to trigger information disclosure. Patched versions are available for all affected branches (14.24, 15.19, 16.15, 17.11, and 18.6+).

sudo dnf update postgresql postgresql-server postgresql-contrib postgresql-devel

Defensia detects this vulnerability

How to check if you are affected

  1. Step 1: Check PostgreSQL version with: psql --version or sudo -u postgres psql -c 'SELECT version();'
  2. Step 2: Verify if SELECT queries with non-ctid inputs against selectivity estimators are logged by running: sudo -u postgres psql -c "SHOW log_statement;" (should show 'all' or 'ddl' for detailed logging)
  3. Step 3: Search PostgreSQL logs for unusual EXPLAIN or CREATE STATISTICS commands with mismatched data types: grep -i 'type mismatch\|selectivity\|ctid' /var/log/postgresql/*.log
  4. Step 4: Confirm the patched version is running by restarting PostgreSQL (sudo systemctl restart postgresql) and re-checking: sudo -u postgres psql -c 'SELECT version();' to verify version is 18.6 or higher

FAQ

What is CVE-2026-14668?

CVE-2026-14668 is a type confusion vulnerability in PostgreSQL's ctid data type selectivity estimator that allows authenticated users to read arbitrary 4-byte memory segments by submitting non-ctid data to functions expecting ctid input, resulting in information disclosure.

Is CVE-2026-14668 being actively exploited?

No, there is no evidence of active exploitation in the wild according to CISA KEV data, and no public exploits have been released. However, it requires authentication and poses a meaningful risk to systems with untrusted database users.

What versions of PostgreSQL are affected by CVE-2026-14668?

PostgreSQL versions 14.0–14.23, 15.0–15.18, 16.0–16.14, 17.0–17.10, and 18.0–18.5 are affected. Versions 14.24, 15.19, 16.15, 17.11, and 18.6+ contain the fix.

How do I check if my server is vulnerable to CVE-2026-14668?

Run `sudo -u postgres psql -c 'SELECT version();'` and compare the version number against the affected ranges above. If your version falls within 18.0–18.5 (or the corresponding ranges for other branches), your server is vulnerable.

Does Defensia detect CVE-2026-14668?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-14668 will appear in your dashboard with remediation steps.

Related PostgreSQL CVEs

CVE-2026-15742CVSS 8.8Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14670CVSS 8.8Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14669CVSS 8.8Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14671CVSS 8.8Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14664CVSS 8.8Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-14668. Free for 1 server.

Get started free