Description

Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before PostgreSQL 18 are unaffected.

Remediation

References

CVE-2026-14676

Related Vulnerabilities

WordPress Plugin Registration Forms-User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Security Bypass (3.8.1.2)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2009-4298)

Sqlite Integer Overflow or Wraparound Vulnerability (CVE-2020-13434)

Apache HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2005-3352)

WordPress Plugin WP Subtitle Unspecified Vulnerability (2.5)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-122 CVE-2026-14676