CVE-2026-14679

PostgreSQL stack buffer overflow in argument match writes 0x0 and 0x1 to server memory

At a glance

Severity: HIGH 8.2
EPSS: EPSS 0.29 % · percentile 22 (2026-10-28)
State: PUBLISHED
Published: 2026-08-13
Updated: 2026-08-29
Assigner: PostgreSQL
NVD status: Modified

Description

Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H	PostgreSQL
CVSS 3.1	HIGH 8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H	NVD · f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 (Secondary)

Weaknesses (CWE)

CWE-121

European references

ENISA EUVD · EUVD-2026-57843
GCVE · GCVE-0-2026-14679

CERT-FR advisories

CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2026-AVI-1336 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1024 — Multiples vulnérabilités dans PostgreSQL · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 14.0 < 14.24
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 15.0 < 15.19
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 16.0 < 16.15
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 17.0 < 17.11
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 18.0 < 18.5

Affected products

Product	Versions
PostgreSQL	affected 18 < 18.6 ; affected 17 < 17.11 ; affected 16 < 16.15 ; affected 15 < 15.19 ; affected 0 < 14.24

References

https://www.postgresql.org/support/security/CVE-2026-14679/

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD