high CVSS 8.8 EPSS 0.44%

CVE-2026-14676·PostgreSQL vulnerability

Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

Severity
high
Software
PostgreSQL
Fixed in
18.5
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.44% — higher than 36% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-14676 scores 8.8 on CVSS, so a successful attack would be serious — but at 0.44%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

From: 18.0

Until: 18.5

Fixed in: 18.5

How to fix this CVE

PostgreSQL versions 18.0 through 18.5 contain a heap buffer overflow vulnerability in the pg_stat_statements module that can be exploited through maliciously crafted array constants in SQL queries. Upgrade to PostgreSQL 18.6 or later to patch this vulnerability and eliminate the risk of arbitrary code execution with database process privileges.

sudo dnf update postgresql-server postgresql-contrib

Defensia detects this vulnerability

How to check if you are affected

  1. Run 'sudo -u postgres psql -c "SELECT version();"' to check the currently installed PostgreSQL version and confirm if it falls within the 18.0-18.5 affected range
  2. Verify pg_stat_statements module is loaded by executing 'sudo -u postgres psql -c "SELECT * FROM pg_extension WHERE extname = 'pg_stat_statements';"' — if the extension is installed, the server is potentially vulnerable
  3. Search PostgreSQL logs (typically in /var/log/postgresql/) for unusual query patterns containing array constants with exceptional sizes or malformed data that may indicate exploitation attempts
  4. After applying the update, re-run 'sudo -u postgres psql -c "SELECT version();"' to confirm PostgreSQL is now version 18.6 or higher

FAQ

What is CVE-2026-14676?

CVE-2026-14676 is a heap buffer overflow in PostgreSQL's pg_stat_statements extension that permits authenticated users to execute arbitrary code with the privileges of the database server process by submitting specially crafted SQL queries containing malformed array constants.

Is CVE-2026-14676 being actively exploited?

According to CISA, CVE-2026-14676 is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog, and no public exploits are known to be available at this time.

What versions of PostgreSQL are affected by CVE-2026-14676?

PostgreSQL versions 18.0 through 18.5 are affected by this vulnerability. PostgreSQL 17 and earlier major versions, as well as PostgreSQL 18.6 and later, are not vulnerable.

How do I check if my server is vulnerable to CVE-2026-14676?

Execute 'sudo -u postgres psql -c "SELECT version();"' to determine your PostgreSQL version. If the output shows a version number between 18.0 and 18.5 and pg_stat_statements is enabled, your system is vulnerable.

Does Defensia detect CVE-2026-14676?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-14676 will appear in your dashboard with remediation steps.

Related PostgreSQL CVEs

CVE-2026-14671CVSS 8.8Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14680CVSS 8.8Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14677CVSS 8.8Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-15741CVSS 8.8SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14670CVSS 8.8Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-14676. Free for 1 server.

Get started free