CVE-2026-6575 PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array

🗓️ 14 May 2026 13:00:14Reported by PostgreSQLType

CVE-2026-6575: pg_restore_attribute_stats may read past end of the stats array in PostgreSQL eighteen before eighteen four.

Reporter	Title	Published	Views	Family All 58
ATTACKERKB	CVE-2026-6575	14 May 202613:00	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : postgresql18, postgresql18-contrib, postgresql18-llvmjit (ALAS2023-2026-1780)	8 Jun 202600:00	–	nessus
Tenable Nessus	FreeBSD : PostgreSQL -- Multiple vulnerabilities (7185ecc9-4fb7-11f1-bc50-6cc21735f730)	15 May 202600:00	–	nessus
Tenable Nessus	openSUSE 16 Security Update : postgresql18 (openSUSE-SU-2026:20901-1)	11 Jun 202600:00	–	nessus
Tenable Nessus	PostgreSQL 14.x < 14.23 / 15.x < 15.18 / 16.x < 16.14 / 17.x < 17.10 / 18.x < 18.4 Multiple Vulnerabilities	22 May 202600:00	–	nessus
Tenable Nessus	SUSE SLED15 / SLES15 Security Update : postgresql18 (SUSE-SU-2026:1944-1)	19 May 202600:00	–	nessus
Tenable Nessus	SUSE SLES15 Security Update : postgresql18 (SUSE-SU-2026:1945-1)	19 May 202600:00	–	nessus
Tenable Nessus	SUSE SLES12 Security Update : postgresql18 (SUSE-SU-2026:1946-1)	19 May 202600:00	–	nessus
Tenable Nessus	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : PostgreSQL vulnerabilities (USN-8294-1)	22 May 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-6575	14 May 202600:00	–	nessus

[
  {
    "defaultStatus": "unaffected",
    "product": "PostgreSQL",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "18.4",
        "status": "affected",
        "version": "18",
        "versionType": "rpm"
      }
    ]
  }
]

Source	Link
postgresql	www.postgresql.org/support/security/CVE-2026-6575/

14 May 2026 13:00Current

CVSS 3.14.3

EPSS0.00032

CWE-126