PostgreSQL Security Update Advisory

PostgreSQL Security Update Advisory

Several vulnerabilities have been identified in PostgreSQL, and security updates addressing these issues have been released. This affects PostgreSQL versions 14.24, 15.19, 16.15, 17.11, And versions prior to 18.5, As well as some 32-bit builds.

The vulnerabilities addressed in this update include the following:

• A vulnerability in psql (the PostgreSQL command-line client) where an early failure in COPY FROM STDIN causes data rows to be processed as psql commands (CVE-2026-6464).
• An arbitrary code execution vulnerability caused by a lack of permission verification during logical decoding (CVE-2026-6471).
• An out-of-bounds memory write vulnerability caused by integer wraparound in functions for the tsvector and tsquery data types (CVE-2026-14662).
• A heap buffer overflow vulnerability in the regular expression processing (CVE-2026-14664).
• A memory disclosure vulnerability caused by type confusion in the ctid data type selector (CVE-2026-14668).
• Arbitrary code execution vulnerability caused by a heap buffer overflow in the to_char(timestamptz) function (CVE-2026-14669).
• Arbitrary code execution vulnerability caused by a heap buffer overflow in plperl (CVE-2026-14670).
• Arbitrary code execution vulnerability caused by type confusion in the refint module (CVE-2026-14671).
• Arbitrary code execution vulnerability in pgstatstatements caused by a heap buffer overflow (CVE-2026-14676).
• Out-of-bounds write vulnerability in pltcl and plperl on 32-bit builds (CVE-2026-14677).
• Stack buffer overflow vulnerability in the argument name matching process (CVE-2026-14679).
• Arbitrary code execution vulnerability caused by type confusion in internal data type arguments (CVE-2026-14680).
• SQL injection vulnerability in the EXTRACT() expression deparse process (CVE-2026-15741).
• Arbitrary memory write vulnerability caused by integer wraparound in fuzzystrmatch (CVE-2026-15742).
• Arbitrary code execution vulnerability due to type confusion in the pgrestoreattribute_stats() function (CVE-2026-16238).
• Arbitrary code execution vulnerability caused by a type confusion in the cursor CLOSE and DECLARE processes (CVE-2026-16239).
• Arbitrary code execution vulnerability in psql discovered through the \unrestrict meta-command (CVE-2026-18408).
• Arbitrary code execution vulnerability caused by a heap buffer overflow in pg_dump (CVE-2026-19385).

As per the published guidance, users of these versions should update to the latest version with the Vulnerability Patch.