CVE-2026-14676

PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code

Published: 8/13/2026 Last updated: 8/29/2026 Reserved: 7/3/2026

Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

CNA assigner: PostgreSQL (f86ef6dc-4d3a-42ad-8f28-e6d5547a5007) Requested by: n/a

Metrics

Version	Score	Severity	Vector String
3.1	8.8	High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Opam packages affected (5)

conf-mingw-w64-postgresql-i686 conf-mingw-w64-postgresql-x86_64 conf-postgresql ocsigen-start postgresql

Products affected (0)

No product listed.

References (1)

https://www.postgresql.org/support/security/CVE-2026-14676/

Credits (1)

The PostgreSQL project thanks Sajeeb Lohani (with TrendAI Zero Day Initiative), Yuelin Wang, and David Korczynski (Claude and Ada Logics) for reporting this problem.