high CVSS 8.8 EPSS 1.0%

CVE-2026-6473·PostgreSQL vulnerability

Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Severity
high
Software
PostgreSQL
Fixed in
18.4
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 1.0% — higher than 62% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

From: 18.0

Until: 18.4

Fixed in: 18.4

How to fix this CVE

Upgrade PostgreSQL to version 18.4 or later to patch the integer wraparound vulnerability that could allow unprivileged database users to trigger memory allocation errors. Organizations running PostgreSQL 18.0–18.3 should prioritize this update, as the flaw can lead to out-of-bounds memory writes and potential code execution under the database process user account. Apply the patch during a maintenance window and validate functionality before returning to production.

sudo dnf update postgresql-server postgresql-contrib

Defensia detects this vulnerability

How to check if you are affected

  1. Step 1: Check the installed PostgreSQL version by running: sudo -u postgres psql --version or psql --version
  2. Step 2: Verify if the database allows unprivileged user connections by querying: SELECT usename, usesuper FROM pg_user; to identify non-superuser accounts
  3. Step 3: Search PostgreSQL server logs (typically in /var/log/postgresql/) for segmentation faults or memory allocation errors: grep -i 'segmentation\|allocation\|wraparound' /var/log/postgresql/*.log
  4. Step 4: After applying the patch, confirm the updated version: sudo -u postgres psql --version and restart the service: sudo systemctl restart postgresql

FAQ

What is CVE-2026-6473?

CVE-2026-6473 is an integer wraparound flaw in PostgreSQL's memory allocation routines that allows unprivileged database users to trigger undersized buffer allocations, leading to out-of-bounds memory writes and potential arbitrary code execution.

Is CVE-2026-6473 being actively exploited?

No, this vulnerability is not currently listed on the CISA KEV catalog and no public exploits are available. However, the high CVSS score (8.8) and remote exploitability make timely patching essential.

What versions of PostgreSQL are affected by CVE-2026-6473?

PostgreSQL versions 18.0 through 18.3 are affected. Versions 14.x before 14.23, 15.x before 15.18, 16.x before 16.14, and 17.x before 17.10 are also vulnerable.

How do I check if my server is vulnerable to CVE-2026-6473?

Run psql --version or sudo -u postgres psql --version and compare the output against the affected version list. If running 18.0–18.3, the system is vulnerable until upgraded to 18.4 or later.

Does Defensia detect CVE-2026-6473?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-6473 will appear in your dashboard with remediation steps.

Related PostgreSQL CVEs

CVE-2026-19385CVSS 8.8Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14669CVSS 8.8Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-18408CVSS 8.8Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14670CVSS 8.8Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14664CVSS 8.8Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-6473. Free for 1 server.

Get started free