CVE-2026-14679

Details

Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Affected Packages

PostgreSQL

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1703)Windows 10 (1709)Windows 10 (1803)

Fixed in:

14.2415.1916.1517.1118.6

postgresql@14

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@15

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@16

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@17

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@18

brew

Fixed in:

14.2415.1916.1517.1118.6

References

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-14679

WEB

https://www.postgresql.org/support/security/CVE-2026-14679/