CVE-2026-6477 Details
Description
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
A stack buffer overflow vulnerability has been identified in PostgreSQL's libpq library, specifically within the lo_export, lo_read, lo_lseek64, and lo_tell64 functions. This vulnerability allows a server superuser to overwrite a client's stack memory by sending an arbitrarily large response. The issue arises because the PQfn function, when called with result_is_int set to 0, transfers variable-length data determined by the server into a buffer of undefined size. Both the lo_export command in psql and pg_dump utilize lo_read(), creating a vector for superusers to manipulate the stack memory of these tools. Affected versions include those prior to PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23.
Users can upgrade to PostgreSQL versions 18.4, 17.10, 16.14, 15.18, or 14.23 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | redhat-SADP |
| CWE-242 | Use of Inherently Dangerous Function | PostgreSQL |
Affected Products
| Product | Versions |
|---|---|
| postgresql postgresql | < 14.23 >= 15.0, < 15.18 >= 16.0, < 16.14 >= 17.0, < 17.10 >= 18.0, < 18.4 |
CPE
Remediation
| |
Change History
20 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 25, 2026 | CVE Modified | redhat-SADP |
| Aug 14, 2026 | CVE Modified | redhat-SADP |
| Aug 6, 2026 | CVE Modified | redhat-SADP |
| Aug 4, 2026 | CVE Modified | redhat-SADP |
| Aug 3, 2026 | CVE Modified | redhat-SADP |
| Jul 29, 2026 | CVE Modified | redhat-SADP |
| Jul 24, 2026 | CVE Modified | redhat-SADP |
| Jul 23, 2026 | CVE Modified | redhat-SADP |
| Jul 21, 2026 | CVE Modified | redhat-SADP |
| Jul 17, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 6, 2026 | CVE Modified | redhat-SADP |
| Jul 2, 2026 | CVE Modified | redhat-SADP |
| Jul 1, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | PostgreSQL |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 14, 2026 | New CVE Received | PostgreSQL |