VYPR
patchPublished Aug 13, 2026· Updated Aug 16, 2026· 1 source

PostgreSQL: 25 Vulnerabilities Disclosed, Many Allowing Code Execution

Key findings • 25 CVEs disclosed for PostgreSQL on August 13, 2026, with multiple High-severity flaws. • Arbitrary code execution is possible via authorization bypass, type confusion, and buf…

Key findings

  • 25 CVEs disclosed for PostgreSQL on August 13, 2026, with multiple High-severity flaws.
  • Arbitrary code execution is possible via authorization bypass, type confusion, and buffer overflows in core components.
  • Vulnerabilities affect pg_dump, psql, logical decoding, and procedural languages like plperl.
  • Integer wraparound and SQL injection flaws also present significant risks.
  • Affected versions include those prior to PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 for many critical issues.
  • Immediate patching and security review are crucial for all PostgreSQL deployments.

On August 13, 2026, a significant batch of 25 vulnerabilities was disclosed for PostgreSQL, spanning multiple components and attack vectors. These vulnerabilities, disclosed within a mere two-minute window, range in severity from Low to High, with a notable cluster of High-severity flaws carrying a CVSSv3 score of 8.8. The sheer volume and critical nature of these disclosures highlight potential risks for organizations relying on PostgreSQL for their database needs.

Several vulnerabilities center around authorization bypass and type confusion, enabling attackers to achieve arbitrary code execution. CVE-2026-6471, a High-severity flaw, allows a non-superuser with REPLICATION privileges to load arbitrary libraries and execute code as the server's operating system user by exploiting missing authorization in logical decoding. Similarly, CVE-2026-16239 and CVE-2026-16238, both rated High, involve type confusion in cursor lifecycle management and pg_restore_attribute_stats respectively, leading to arbitrary code execution. CVE-2026-14680 also falls into this category, where type confusion with "internal" data type arguments allows any user to execute arbitrary code.

Another group of vulnerabilities involves untrusted data inclusion and heap buffer overflows, also leading to code execution. CVE-2026-19385, a High-severity bug in pg_dump, allows an object creator to execute arbitrary code via a crafted transform list. CVE-2026-18408, another High-severity issue in pg_dump, permits a malicious superuser to inject code for restore-time execution. Heap buffer overflows are present in CVE-2026-14669 (to_char(timestamptz)), CVE-2026-14670 (plperl return of a tied hash), and CVE-2026-14664 (regexp), all with High severity and the potential for arbitrary code execution.

Integer wraparound vulnerabilities also pose a significant risk. CVE-2026-15742, rated High, in the fuzzystrmatch module allows for arbitrary code execution through extreme inputs to Levenshtein functions. CVE-2026-14677, also High, affects 32-bit builds of pltcl and plperl, potentially leading to out-of-bounds writes and arbitrary code execution.

Other notable vulnerabilities include SQL injection in CVE-2026-15741 (EXTRACT() deparse), allowing superuser-level SQL execution, and missing authorization in DDL commands in CVE-2026-6470, which can lead to denial of service. CVE-2026-6464 presents a risk of arbitrary code execution via error injection in psql's COPY command.

The disclosed vulnerabilities affect various versions of PostgreSQL, with specific fixes mentioned for versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 for many of the critical flaws. Users are strongly advised to consult the official PostgreSQL security advisories for detailed information on affected versions and apply patches promptly. The coordinated disclosure of these numerous vulnerabilities underscores the importance of maintaining up-to-date PostgreSQL installations and regularly reviewing security announcements.

The batch of 25 CVEs disclosed on August 13, 2026, presents a critical security challenge for PostgreSQL users. The prevalence of High-severity vulnerabilities, particularly those enabling arbitrary code execution through authorization bypass, type confusion, and buffer overflows, demands immediate attention. Organizations should prioritize patching and review their configurations to mitigate these risks. The wide range of affected components indicates a need for a thorough security audit of PostgreSQL deployments.

Key findings from this batch include:

  • Multiple High-severity vulnerabilities (CVSSv3 8.8) allowing arbitrary code execution through type confusion and buffer overflows.
  • Authorization bypass flaws in logical decoding and DDL commands enabling privilege escalation and denial of service.
  • SQL injection and untrusted data inclusion vulnerabilities in tools like pg_dump and psql, leading to code execution.
  • Integer wraparound issues in fuzzystrmatch and procedural languages (pltcl, plperl) posing code execution risks.
  • Patches are available for versions prior to PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 for many critical flaws.
  • A broad spectrum of components are affected, from core functions to utility programs like pg_dump and psql.
Synthesized by Vypr AI