CVE-2026-14676 PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code
A heap buffer overflow in PostgreSQL pg_stat_statements allows query authors to execute arbitrary code as the database OS user via crafted array constants.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-14676?
CVE-2026-14676 is a high-severity memory corruption vulnerability in Postgresql Postgresql, published on 13 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.
Weakness: CWE-122
Which versions are affected by CVE-2026-14676?
1 open source package ship an affected version, including postgresql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
postgresql Bitnami | From 18.0.0 | 18.5.0 |
Products include Postgresql Postgresql.
How do I fix CVE-2026-14676?
Upgrade postgresql to 18.5.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-14676 being exploited?
There is no known exploitation of CVE-2026-14676 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as ALPINE-CVE-2026-14676, BELL-CVE-2026-14676, BIT-postgresql-2026-14676, DEBIAN-CVE-2026-14676, GHSA-8848-x36c-v99q, MINI-88wr-746v-5rvv and 1 more.