CVE-2026-6477 PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory

High 8.8 Published 14 May 2026 Updated 25 Aug 2026

A malicious server superuser can overwrite client stack memory in libpq via lo_* functions, potentially enabling code execution on the client.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-6477?

CVE-2026-6477 is a high-severity memory corruption vulnerability in Postgresql Postgresql, published on 14 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Weakness: CWE-120, CWE-242

Which versions are affected by CVE-2026-6477?

1 open source package ship an affected version, including postgresql. It affects 1 product.

Package	Affected	Fixed in
`postgresql` Bitnami	All versions	`14.23.0, 15.18.0, 16.14.0, 17.10.0, 18.4.0`

Linux distribution packages (39)

`libpq` AlmaLinux:10	All versions	`16.14-1.el10_2`
`libpq-devel` AlmaLinux:10	All versions	`16.14-1.el10_2`
`libpq` AlmaLinux:9	All versions	`13.23-3.el9_8`
`libpq-devel` AlmaLinux:9	All versions	`13.23-3.el9_8`
`libpq` Red Hat:enterprise_linux:10.2	All versions	`0:16.14-1.el10_2`
`libpq-debuginfo` Red Hat:enterprise_linux:10.2	All versions	`0:16.14-1.el10_2`
`libpq-debugsource` Red Hat:enterprise_linux:10.2	All versions	`0:16.14-1.el10_2`
`libpq-devel` Red Hat:enterprise_linux:10.2	All versions	`0:16.14-1.el10_2`
`libpq-devel-debuginfo` Red Hat:enterprise_linux:10.2	All versions	`0:16.14-1.el10_2`
`libpq` Red Hat:enterprise_linux:9::appstream	All versions	`0:13.23-3.el9_8`
`libpq-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:13.23-3.el9_8`
`libpq-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`0:13.23-3.el9_8`
`libpq-devel` Red Hat:enterprise_linux:9::appstream	All versions	`0:13.23-3.el9_8`
`libpq-devel-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:13.23-3.el9_8`
`libpq` Red Hat:enterprise_linux_eus:10.0	All versions	`0:16.14-0.el10_0.1`
`libpq-debuginfo` Red Hat:enterprise_linux_eus:10.0	All versions	`0:16.14-0.el10_0.1`
`libpq-debugsource` Red Hat:enterprise_linux_eus:10.0	All versions	`0:16.14-0.el10_0.1`
`libpq-devel` Red Hat:enterprise_linux_eus:10.0	All versions	`0:16.14-0.el10_0.1`
`libpq-devel-debuginfo` Red Hat:enterprise_linux_eus:10.0	All versions	`0:16.14-0.el10_0.1`
`libpq` Red Hat:rhel_aus:8.6::appstream	All versions	`0:13.23-1.el8_6.1`
`libpq-debuginfo` Red Hat:rhel_aus:8.6::appstream	All versions	`0:13.23-1.el8_6.1`
`libpq-debugsource` Red Hat:rhel_aus:8.6::appstream	All versions	`0:13.23-1.el8_6.1`
`libpq-devel` Red Hat:rhel_aus:8.6::appstream	All versions	`0:13.23-1.el8_6.1`
`libpq-devel-debuginfo` Red Hat:rhel_aus:8.6::appstream	All versions	`0:13.23-1.el8_6.1`
`libpq` Red Hat:rhel_e4s:9.2::appstream	All versions	`0:13.23-1.el9_2.1`
`libpq-debuginfo` Red Hat:rhel_e4s:9.2::appstream	All versions	`0:13.23-1.el9_2.1`
`libpq-debugsource` Red Hat:rhel_e4s:9.2::appstream	All versions	`0:13.23-1.el9_2.1`
`libpq-devel` Red Hat:rhel_e4s:9.2::appstream	All versions	`0:13.23-1.el9_2.1`
`libpq-devel-debuginfo` Red Hat:rhel_e4s:9.2::appstream	All versions	`0:13.23-1.el9_2.1`
`libpq` Red Hat:rhel_e4s:9.4::appstream	All versions	`0:13.23-1.el9_4.1`
`libpq-debuginfo` Red Hat:rhel_e4s:9.4::appstream	All versions	`0:13.23-1.el9_4.1`
`libpq-debugsource` Red Hat:rhel_e4s:9.4::appstream	All versions	`0:13.23-1.el9_4.1`
`libpq-devel` Red Hat:rhel_e4s:9.4::appstream	All versions	`0:13.23-1.el9_4.1`
`libpq-devel-debuginfo` Red Hat:rhel_e4s:9.4::appstream	All versions	`0:13.23-1.el9_4.1`
`libpq` Red Hat:rhel_eus:9.6::appstream	All versions	`0:13.23-1.el9_6.1`
`libpq-debuginfo` Red Hat:rhel_eus:9.6::appstream	All versions	`0:13.23-1.el9_6.1`
`libpq-debugsource` Red Hat:rhel_eus:9.6::appstream	All versions	`0:13.23-1.el9_6.1`
`libpq-devel` Red Hat:rhel_eus:9.6::appstream	All versions	`0:13.23-1.el9_6.1`
`libpq-devel-debuginfo` Red Hat:rhel_eus:9.6::appstream	All versions	`0:13.23-1.el9_6.1`

Products include Postgresql Postgresql.

How do I fix CVE-2026-6477?

Upgrade postgresql to a fixed version for your release line: 14.23.0, 15.18.0, 16.14.0 or 17.10.0.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-6477 being exploited?

There is no known exploitation of CVE-2026-6477 in the wild and no public exploit code.

All Postgresql Postgresql vulnerabilities

Sources

Also known as ALPINE-CVE-2026-6477, ALSA-2026:44308, ALSA-2026:44391, AZL-86840, BELL-CVE-2026-6477, BIT-postgresql-2026-6477 and 21 more.