high CVSS 8.1 EPSS 0.36%

CVE-2026-6464·PostgreSQL vulnerability

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands. "COPY FROM" with a filename is unaffected. The server administrator has no inherent control over the data rows, so a complete attack requires the attacker to separately acquire control of both the server and the data rows. Alternatively, an attacker controlling data rows alone might complete an attack through a coincidental error that they don't control. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity
high
Software
PostgreSQL
Fixed in
18.5
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.36% — higher than 27% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-6464 scores 8.1 on CVSS, so a successful attack would be serious — but at 0.36%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

From: 18.0

Until: 18.5

Fixed in: 18.5

How to fix this CVE

Upgrade PostgreSQL to version 18.6 or later to patch a command injection vulnerability in the psql COPY statement handler. Organizations running PostgreSQL 18.0–18.5 should prioritize this update, as the vulnerability allows psql to misinterpret data rows as commands when COPY FROM STDIN fails before input is expected. Apply the update during a maintenance window and restart the PostgreSQL service to complete remediation.

sudo dnf update postgresql postgresql-server postgresql-contrib

Defensia detects this vulnerability

How to check if you are affected

  1. Step 1: Check your PostgreSQL version by running: psql --version or sudo -u postgres psql -c 'SELECT version();'
  2. Step 2: Verify if psql is used interactively on the server by checking installed packages: dpkg -l | grep postgresql (Debian/Ubuntu) or rpm -qa | grep postgresql (RHEL/CentOS)
  3. Step 3: Search PostgreSQL logs for failed COPY FROM STDIN commands followed by unexpected command execution: grep -i 'COPY.*STDIN' /var/log/postgresql/*.log and look for command patterns after errors
  4. Step 4: After upgrading, confirm the new version with psql --version and verify no COPY mishandling occurs by testing a failed COPY statement in a test environment

FAQ

What is CVE-2026-6464?

CVE-2026-6464 is a command injection flaw in PostgreSQL's psql utility where premature COPY FROM STDIN failures cause data rows to be misinterpreted and executed as psql metacommands, potentially allowing unauthorized command execution.

Is CVE-2026-6464 being actively exploited?

No, CVE-2026-6464 is not listed on the CISA KEV catalog and no public exploits are currently available. However, exploitation requires dual control of both the PostgreSQL server and input data, making real-world attacks less likely but still possible.

What versions of PostgreSQL are affected by CVE-2026-6464?

PostgreSQL versions 14.0–14.23, 15.0–15.18, 16.0–16.14, 17.0–17.10, and 18.0–18.5 are affected. Fixed versions are PostgreSQL 14.24, 15.19, 16.15, 17.11, and 18.6 respectively.

How do I check if my server is vulnerable to CVE-2026-6464?

Run: sudo -u postgres psql -c 'SELECT version();' If your version number is 18.5 or earlier (and correspondingly 17.10 or earlier for the 17 branch, etc.), your installation is vulnerable.

Does Defensia detect CVE-2026-6464?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-6464 will appear in your dashboard with remediation steps.

Related PostgreSQL CVEs

CVE-2026-14671CVSS 8.8Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14680CVSS 8.8Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14677CVSS 8.8Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14676CVSS 8.8Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.
CVE-2026-15741CVSS 8.8SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-6464. Free for 1 server.

Get started free