Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2026-6477

PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory

At a glance

Severity
HIGH 8.8
EPSS
EPSS 0.45 % · percentile 39 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
PostgreSQL
NVD status
Modified

Description

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HPostgreSQL
CVSS 3.1HIGH 8.4CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:Hredhat-SADP
CVSS 3.1HIGH 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HNVD · f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 (Secondary)
CVSS 3.1HIGH 8.4CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:HNVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

Weaknesses (CWE)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
PostgreSQLaffected 18 < 18.4 ; affected 17 < 17.10 ; affected 16 < 16.14 ; affected 15 < 15.18 ; affected 0 < 14.23

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD