Medium severity4.3NVD Advisory· Published May 14, 2026· Updated May 18, 2026
CVE-2026-6575
CVE-2026-6575
Description
Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major version 18, minor versions before PostgreSQL 18.4 are affected. Versions before PostgreSQL 18 are unaffected.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6- Range: <18.4
- osv-coords4 versionspkg:bitnami/postgresqlpkg:rpm/opensuse/postgresql18&distro=openSUSE%20Tumbleweedpkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/postgresql18&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
>= 18.0.0, < 18.4.0+ 3 more
- (no CPE)range: >= 18.0.0, < 18.4.0
- (no CPE)range: < 18.4-1.1
- (no CPE)range: < 18.4-160000.1.1
- (no CPE)range: < 18.4-160000.1.1
Patches
Vulnerability mechanics
References
1- www.postgresql.org/support/security/CVE-2026-6575/nvdPatchVendor Advisory
News mentions
0No linked articles in our index yet.