CVE-2026-14671 PostgreSQL refint plan cache type confusion executes arbitrary code
An attacker with object creation privileges can execute arbitrary code via type confusion in the refint module's plan cache.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-14671?
CVE-2026-14671 is a high-severity memory corruption vulnerability in Postgresql Postgresql, published on 13 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Weakness: CWE-843
Which versions are affected by CVE-2026-14671?
1 open source package ship an affected version, including postgresql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
postgresql Bitnami | All versions | 14.24.0, 15.19.0, 16.15.0, 17.11.0, 18.5.0 |
Products include Postgresql Postgresql.
How do I fix CVE-2026-14671?
Upgrade postgresql to a fixed version for your release line: 14.24.0, 15.19.0, 16.15.0 or 17.11.0.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-14671 being exploited?
There is no known exploitation of CVE-2026-14671 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as ALPINE-CVE-2026-14671, AZL-95750, BELL-CVE-2026-14671, BIT-postgresql-2026-14671, DEBIAN-CVE-2026-14671, ECHO-ff26-7665-b32e and 9 more.