What is CVE-2026-14676?

CVE-2026-14676 is a high-severity vulnerability in Postgresql, classified under Heap-based Buffer Overflow. CVSS score: 8.8/10. Published 2026-08-13.

How severe is CVE-2026-14676?

High severity. CVSS v3 base score is 8.8 out of 10.

Buffer overflow in Postgresql

CVE-2026-14676

Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor vers…

Vulnerability class: Buffer Overflow

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

N/a Postgresql — versions 18

Weakness classification (CWE)

CWE-122 — Heap-based Buffer Overflow

References

f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Frequently asked questions

What is CVE-2026-14676?: CVE-2026-14676 is a high-severity vulnerability in Postgresql, classified under Heap-based Buffer Overflow. CVSS score: 8.8/10. Published 2026-08-13.
How severe is CVE-2026-14676?: High severity. CVSS v3 base score is 8.8 out of 10.