CVE-2026-6575·PostgreSQL vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.30% — higher than 21% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

PostgreSQL 18.0 through 18.3 contain a buffer over-read vulnerability in the pg_restore_attribute_stats() function that permits authenticated table maintainers to read unintended memory values. Upgrade to PostgreSQL 18.4 or later to remediate this information disclosure vulnerability and prevent unauthorized memory access.

sudo dnf update postgresql-server postgresql-contrib postgresql-libs

How to check if you are affected

1. Check installed PostgreSQL version: psql --version or SELECT version(); in a psql session
2. Verify the vulnerable component is active: SELECT * FROM pg_extension WHERE extname='pg_restore'; to check if extension is loaded
3. Search PostgreSQL logs for pg_restore_attribute_stats() calls: grep -i 'pg_restore_attribute_stats' /var/log/postgresql/*.log
4. Confirm remediation by verifying upgraded version matches 18.4 or later: SELECT version();

FAQ

Related PostgreSQL CVEs

References

• https://www.postgresql.org/support/security/CVE-2026-6575/