CVE-2026-14680
PostgreSQL type confusion via "internal" arguments
HIGH 8.8
At a glance
- Source
- NVD
- EPSS
- EPSS 0.42 % · percentile 36 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- PostgreSQL
- NVD status
- Modified
Description
Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Weaknesses (CWE)
- CWE-843 — Type Confusion (Access of Resource Using Incompatible Type)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | PostgreSQL |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-57844
- GCVE · GCVE-0-2026-14680
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1336 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1024 — Multiples vulnérabilités dans PostgreSQL · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*≥ 14.0 < 14.24cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*≥ 15.0 < 15.19cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*≥ 16.0 < 16.15cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*≥ 17.0 < 17.11cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*≥ 18.0 < 18.5
Affected products
| Product | Versions |
|---|---|
| PostgreSQL | affected 18 < 18.6 ; affected 17 < 17.11 ; affected 16 < 16.15 ; affected 15 < 15.19 ; affected 0 < 14.24 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |