CVE-2026-14671

Details

Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Affected Packages

PostgreSQL

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1703)Windows 10 (1709)Windows 10 (1803)

Fixed in:

14.2415.1916.1517.1118.6

postgresql@14

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@15

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@16

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@17

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@18

brew

Fixed in:

14.2415.1916.1517.1118.6

References

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-14671

WEB

https://www.postgresql.org/support/security/CVE-2026-14671/