high CVSS 8.8 EPSS 0.44%

CVE-2026-14670·PostgreSQL vulnerability

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity
high
Software
PostgreSQL
Fixed in
18.5
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.44% — higher than 36% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-14670 scores 8.8 on CVSS, so a successful attack would be serious — but at 0.44%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

From: 18.0

Until: 18.5

Fixed in: 18.5

How to fix this CVE

Upgrade PostgreSQL to version 18.6 or later to patch a heap buffer overflow in the plperl extension that could allow authenticated users to execute arbitrary code with database server privileges. Organizations running PostgreSQL 14.x through 18.x should prioritize this update, particularly if plperl functions are deployed. After upgrading, restart the PostgreSQL service and validate that all plperl functions execute without errors.

sudo dnf update postgresql-server postgresql-contrib --disablerepo='*' --enablerepo='rhel-*-appstream-rpms'

Defensia detects this vulnerability

How to check if you are affected

  1. Check installed PostgreSQL version: sudo -u postgres psql -c 'SELECT version();' — confirm if it is below 18.6, 17.11, 16.15, 15.19, or 14.24
  2. Verify if plperl is installed: sudo -u postgres psql -c "SELECT * FROM pg_available_extensions WHERE name='plperl';" — if installed, the vulnerability surface is active
  3. Search PostgreSQL logs for plperl function execution errors: grep -i 'plperl' /var/log/postgresql/postgresql.log | grep -i 'error\|segfault\|buffer'
  4. Confirm the patch was applied by re-running the version check and verifying the version number matches or exceeds the fixed version for your branch

FAQ

What is CVE-2026-14670?

CVE-2026-14670 is a heap buffer overflow vulnerability in PostgreSQL's plperl extension that occurs when a plperl function returns a tied hash object. An authenticated database user who owns or can execute such a function can trigger memory corruption leading to arbitrary code execution with the privileges of the PostgreSQL server process.

Is CVE-2026-14670 being actively exploited?

No, there is no evidence of active exploitation in the wild, and no public exploits have been disclosed. However, the vulnerability requires only local database authentication and knowledge of plperl function construction, so proactive patching is still critical.

What versions of PostgreSQL are affected by CVE-2026-14670?

PostgreSQL versions 14 through 18.5 are affected. The vulnerability was fixed in PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24. Users should upgrade to at least these versions for their respective release branch.

How do I check if my server is vulnerable to CVE-2026-14670?

Run 'sudo -u postgres psql -c "SELECT version();"' to get your PostgreSQL version. Cross-reference it against the affected version ranges. If plperl is installed (check with 'CREATE EXTENSION IF NOT EXISTS plperl;'), the system is potentially vulnerable if running an unpatched version.

Does Defensia detect CVE-2026-14670?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-14670 will appear in your dashboard with remediation steps.

Related PostgreSQL CVEs

CVE-2026-14664CVSS 8.8Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14669CVSS 8.8Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-15742CVSS 8.8Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14671CVSS 8.8Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-16238CVSS 8.8Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-14670. Free for 1 server.

Get started free