CVE-2026-19385

PostgreSQL PG_dump is affected by a heap buffer overflow in the handling of long function transform lists, allowing an attacker to execute arbitrary code as the operating system user running pg_dump. Affected versions are PostgreSQL prior to 18.5, 17.11, 16.15, 15.19, and 14.24. There is no explo...

EUVD-2026-57853

Heap buffer overflow in PostgreSQL pgdump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pgdump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-19385

Heap buffer overflow in PostgreSQL pgdump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pgdump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-19385

Heap buffer overflow in PostgreSQL pgdump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pgdump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-19385 PostgreSQL pg_dump heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL pgdump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pgdump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

EUVD-2026-57842

Buffer over-read in PostgreSQL pgtrgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14678

Buffer over-read in PostgreSQL pgtrgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14678 PostgreSQL pg_trgm picksplit reads past end of buffer

Buffer over-read in PostgreSQL pgtrgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14676

Heap buffer overflow in PostgreSQL pgstatstatements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before...

CVE-2026-14676

Heap buffer overflow in PostgreSQL pgstatstatements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before...

CVE-2026-14676 PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL pgstatstatements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before...

CVE-2026-14676

Summary: CVE-2026-14676 is a heap buffer overflow in PostgreSQL’s pg_stat_statements. The issue allows a query author to run arbitrary code on the OS user account running the database when crafting queries with array constants. Affected versions: major version 18 with minor versions before 18.5 a...

CVE-2026-14676 PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL pgstatstatements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before...

CVE-2026-14670 PostgreSQL plperl tied object heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

EUVD-2026-57837

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14670 PostgreSQL plperl tied object heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14670

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14670

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14670

Technical details are not publicly available in the provided documents; monitor for updates.

CVE-2026-14669 PostgreSQL to_char heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...