CVE-2026-14679·PostgreSQL vulnerability
Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
- Severity
- high
- Software
- PostgreSQL
- Fixed in
- 18.5
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.29% — higher than 20% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Read the two together. CVE-2026-14679 scores 8.2 on CVSS, so a successful attack would be serious — but at 0.29%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.
Affected versions
From: 18.0
Until: 18.5
Fixed in: 18.5
How to fix this CVE
PostgreSQL versions 18.0 through 18.5 contain a stack buffer overflow vulnerability in parameter name matching that could allow an authenticated attacker to cause denial of service or data corruption. Upgrade immediately to PostgreSQL 18.6 or later, or apply backported patches if upgrading is not immediately feasible. Review and restrict database object creation permissions for untrusted users.
sudo dnf update postgresql-server postgresql-contrib postgresql-libsDefensia detects this vulnerability
How to check if you are affected
- Check PostgreSQL version: psql --version or SELECT version();
- Confirm vulnerable version range: SELECT version(); — if output shows 18.0 to 18.5, your installation is affected
- Review PostgreSQL logs for failed function creation attempts or unusual parameter-related errors: grep -i 'parameter\|argument\|OUT' /var/log/postgresql/postgresql.log
- Verify the upgrade completed successfully: psql --version should report 18.6 or later, and pg_ctl status should show the server is running with the updated binary
FAQ
What is CVE-2026-14679?
This vulnerability is a stack buffer overflow in PostgreSQL's argument name matching logic that occurs during function creation with OUT parameters. An authenticated attacker with object creation privileges could exploit this to write limited byte values (0x0 and 0x1) to stack memory, potentially causing application crashes or data corruption.
Is CVE-2026-14679 being actively exploited?
No, according to CISA's Known Exploited Vulnerabilities list, this CVE is not currently being actively exploited in the wild. However, public awareness and proof-of-concept availability may increase over time, so timely patching remains important.
What versions of PostgreSQL are affected by CVE-2026-14679?
PostgreSQL versions 18.0 through 18.5 are affected. Fixed versions are 18.6, 17.11, 16.15, 15.19, and 14.24 depending on your release branch.
How do I check if my server is vulnerable to CVE-2026-14679?
Execute 'psql --version' or connect to your database and run 'SELECT version();' — if the version is between 18.0 and 18.5, your server is vulnerable and requires immediate patching.
Does Defensia detect CVE-2026-14679?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-14679 will appear in your dashboard with remediation steps.
Related PostgreSQL CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-14679. Free for 1 server.
Get started free