CVE-2026-14676 — PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code

CVE-2026-14676

PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code PUBLISHED

Description (CNA)

Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

Affected (CNA)

Vendor / product	Versions
n/a / PostgreSQL	affected 18 before 18.6

CWE

CWE-122

References

https://www.postgresql.org/support/security/CVE-2026-14676/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.