PostgreSQL 18.x (pre18.5) Heap B.O. in pg_stat_statements Enables OS Exec
CVE-2026-14676 Published on August 13, 2026
PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code
Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before PostgreSQL 18 are unaffected.
Weakness Type
Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Products Associated with CVE-2026-14676
Want to know whenever a new CVE is published for PostgreSQL? stack.watch will email you.
