High severity8.8NVD Advisory· Published May 14, 2026· Updated Aug 14, 2026
CVE-2026-6477
CVE-2026-6477
Description
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
63- Range: <18.4
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*range: <14.23
- (no CPE)range: <18.4, <17.10, <16.14, <15.18, <14.23
- osv-coords60 versionspkg:bitnami/postgresqlpkg:rpm/almalinux/libpqpkg:rpm/almalinux/libpq-develpkg:rpm/almalinux/pg_repackpkg:rpm/almalinux/pgauditpkg:rpm/almalinux/pgvectorpkg:rpm/almalinux/postgispkg:rpm/almalinux/postgis-clientpkg:rpm/almalinux/postgis-docspkg:rpm/almalinux/postgis-upgradepkg:rpm/almalinux/postgis-utilspkg:rpm/almalinux/postgres-decoderbufspkg:rpm/almalinux/postgresqlpkg:rpm/almalinux/postgresql-contribpkg:rpm/almalinux/postgresql-docspkg:rpm/almalinux/postgresql-plperlpkg:rpm/almalinux/postgresql-plpython3pkg:rpm/almalinux/postgresql-pltclpkg:rpm/almalinux/postgresql-private-develpkg:rpm/almalinux/postgresql-private-libspkg:rpm/almalinux/postgresql-serverpkg:rpm/almalinux/postgresql-server-develpkg:rpm/almalinux/postgresql-staticpkg:rpm/almalinux/postgresql-testpkg:rpm/almalinux/postgresql-test-rpm-macrospkg:rpm/almalinux/postgresql-upgradepkg:rpm/almalinux/postgresql-upgrade-develpkg:rpm/almalinux/postgresql18pkg:rpm/almalinux/postgresql18-contribpkg:rpm/almalinux/postgresql18-docspkg:rpm/almalinux/postgresql18-plperlpkg:rpm/almalinux/postgresql18-plpython3pkg:rpm/almalinux/postgresql18-private-develpkg:rpm/almalinux/postgresql18-private-libspkg:rpm/almalinux/postgresql18-serverpkg:rpm/almalinux/postgresql18-server-develpkg:rpm/almalinux/postgresql18-staticpkg:rpm/almalinux/postgresql18-testpkg:rpm/almalinux/postgresql18-test-rpm-macrospkg:rpm/almalinux/postgresql18-upgradepkg:rpm/almalinux/postgresql18-upgrade-develpkg:rpm/opensuse/postgresql14&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/postgresql14&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/postgresql15&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/postgresql15&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/postgresql16&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/postgresql16&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/postgresql17&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/postgresql17&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/postgresql18&distro=openSUSE%20Tumbleweedpkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
< 14.23.0+ 59 more
- (no CPE)range: < 14.23.0
- (no CPE)range: < 13.23-2.el8_10
- (no CPE)range: < 13.23-2.el8_10
- (no CPE)range: < 1.5.1-1.module_el9.6.0+146+c54fdeca
- (no CPE)range: < 16.0-1.module_el9.4.0+66+eb9878bc
- (no CPE)range: < 0.6.2-2.module_el9.6.0+167+4e561146
- (no CPE)range: < 3.5.3-5.module_el9.8.0+236+2d3cbd4c
- (no CPE)range: < 3.5.3-5.module_el9.8.0+236+2d3cbd4c
- (no CPE)range: < 3.5.3-5.module_el9.8.0+236+2d3cbd4c
- (no CPE)range: < 3.5.3-5.module_el9.8.0+236+2d3cbd4c
- (no CPE)range: < 3.5.3-5.module_el9.8.0+236+2d3cbd4c
- (no CPE)range: < 2.4.0-1.Final.module_el9.4.0+66+eb9878bc
- (no CPE)range: < 16.14-1.module_el9.8.0+266+1e661e97
- (no CPE)range: < 16.14-1.module_el9.8.0+266+1e661e97
- (no CPE)range: < 16.14-1.module_el9.8.0+266+1e661e97
- (no CPE)range: < 16.14-1.module_el9.8.0+266+1e661e97
- (no CPE)range: < 16.14-1.module_el9.8.0+266+1e661e97
- (no CPE)range: < 16.14-1.module_el9.8.0+266+1e661e97
- (no CPE)range: < 16.14-1.module_el9.8.0+266+1e661e97
- (no CPE)range: < 16.14-1.module_el9.8.0+266+1e661e97
- (no CPE)range: < 16.14-1.module_el9.8.0+266+1e661e97
- (no CPE)range: < 16.14-1.module_el9.8.0+266+1e661e97
- (no CPE)range: < 16.14-1.module_el9.8.0+266+1e661e97
- (no CPE)range: < 16.14-1.module_el9.8.0+266+1e661e97
- (no CPE)range: < 16.14-1.module_el9.8.0+266+1e661e97
- (no CPE)range: < 16.14-1.module_el9.8.0+266+1e661e97
- (no CPE)range: < 16.14-1.module_el9.8.0+266+1e661e97
- (no CPE)range: < 18.4-1.el10_2
- (no CPE)range: < 18.4-1.el10_2
- (no CPE)range: < 18.4-1.el10_2
- (no CPE)range: < 18.4-1.el10_2
- (no CPE)range: < 18.4-1.el10_2
- (no CPE)range: < 18.4-1.el10_2
- (no CPE)range: < 18.4-1.el10_2
- (no CPE)range: < 18.4-1.el10_2
- (no CPE)range: < 18.4-1.el10_2
- (no CPE)range: < 18.4-1.el10_2
- (no CPE)range: < 18.4-1.el10_2
- (no CPE)range: < 18.4-1.el10_2
- (no CPE)range: < 18.4-1.el10_2
- (no CPE)range: < 18.4-1.el10_2
- (no CPE)range: < 14.23-160000.1.1
- (no CPE)range: < 14.23-1.1
- (no CPE)range: < 15.18-160000.1.1
- (no CPE)range: < 15.18-1.1
- (no CPE)range: < 16.14-160000.1.1
- (no CPE)range: < 16.14-1.1
- (no CPE)range: < 17.10-160000.1.1
- (no CPE)range: < 17.10-1.1
- (no CPE)range: < 18.4-1.1
- (no CPE)range: < 14.23-160000.1.1
- (no CPE)range: < 14.23-160000.1.1
- (no CPE)range: < 15.18-160000.1.1
- (no CPE)range: < 15.18-160000.1.1
- (no CPE)range: < 16.14-160000.1.1
- (no CPE)range: < 16.14-160000.1.1
- (no CPE)range: < 17.10-160000.1.1
- (no CPE)range: < 17.10-160000.1.1
- (no CPE)range: < 18.4-160000.1.1
- (no CPE)range: < 18.4-160000.1.1
Patches
Vulnerability mechanics
References
45- www.postgresql.org/support/security/CVE-2026-6477/nvdPatchVendor Advisory
- access.redhat.com/errata/RHSA-2026:21182nvd
- access.redhat.com/errata/RHSA-2026:22878nvd
- access.redhat.com/errata/RHSA-2026:26181nvd
- access.redhat.com/errata/RHSA-2026:26203nvd
- access.redhat.com/errata/RHSA-2026:26204nvd
- access.redhat.com/errata/RHSA-2026:26524nvd
- access.redhat.com/errata/RHSA-2026:26525nvd
- access.redhat.com/errata/RHSA-2026:26561nvd
- access.redhat.com/errata/RHSA-2026:27718nvd
- access.redhat.com/errata/RHSA-2026:27738nvd
- access.redhat.com/errata/RHSA-2026:27741nvd
- access.redhat.com/errata/RHSA-2026:27742nvd
- access.redhat.com/errata/RHSA-2026:27743nvd
- access.redhat.com/errata/RHSA-2026:28037nvd
- access.redhat.com/errata/RHSA-2026:28143nvd
- access.redhat.com/errata/RHSA-2026:28208nvd
- access.redhat.com/errata/RHSA-2026:28999nvd
- access.redhat.com/errata/RHSA-2026:29212nvd
- access.redhat.com/errata/RHSA-2026:29815nvd
- access.redhat.com/errata/RHSA-2026:29904nvd
- access.redhat.com/errata/RHSA-2026:29953nvd
- access.redhat.com/errata/RHSA-2026:32983nvd
- access.redhat.com/errata/RHSA-2026:32994nvd
- access.redhat.com/errata/RHSA-2026:33441nvd
- access.redhat.com/errata/RHSA-2026:33497nvd
- access.redhat.com/errata/RHSA-2026:34043nvd
- access.redhat.com/errata/RHSA-2026:34362nvd
- access.redhat.com/errata/RHSA-2026:34363nvd
- access.redhat.com/errata/RHSA-2026:35880nvd
- access.redhat.com/errata/RHSA-2026:42555nvd
- access.redhat.com/errata/RHSA-2026:44308nvd
- access.redhat.com/errata/RHSA-2026:44391nvd
- access.redhat.com/errata/RHSA-2026:44420nvd
- access.redhat.com/errata/RHSA-2026:44481nvd
- access.redhat.com/errata/RHSA-2026:47090nvd
- access.redhat.com/errata/RHSA-2026:49521nvd
- access.redhat.com/errata/RHSA-2026:49908nvd
- access.redhat.com/errata/RHSA-2026:49909nvd
- access.redhat.com/errata/RHSA-2026:50779nvd
- access.redhat.com/errata/RHSA-2026:50863nvd
- access.redhat.com/errata/RHSA-2026:54760nvd
- access.redhat.com/security/cve/CVE-2026-6477nvd
- bugzilla.redhat.com/show_bug.cginvd
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6477.jsonnvd
News mentions
0No linked articles in our index yet.