CVE-2026-14664 - PostgreSQL regexp heap buffer overflow executes arbitrary code

First Published: 2026/08/13

Important: This assessment evaluates the impact of CVE-2026-14664 on EDB products and services. It links to and details the CVE and supplements that information with EDB's own assessment.

Summary

A heap buffer overflow in PostgreSQL's regexp functions allows a query author to execute arbitrary code as the operating system user running the database, triggered when text that fails encoding validation grows unexpectedly during a round-trip conversion through pg_wchar. This vulnerability shares heritage with CVE-2026-2006. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Vulnerability details

CVE-ID: CVE-2026-14664

CVE Publish Date: 2026/08/13

CVSS Base Score: 8.8

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products and versions

PostgreSQL

  • All versions prior to 18.5
  • All versions prior to 17.11
  • All versions prior to 16.15
  • All versions prior to 15.19
  • All versions prior to 14.24

EnterpriseDB Postgres Advanced Server (EPAS)

  • All versions prior to 18.5
  • All versions prior to 17.11
  • All versions prior to 16.15
  • All versions prior to 15.19
  • All versions prior to 14.24

EnterpriseDB Postgres Extended (PGE)

  • All versions prior to 18.5
  • All versions prior to 17.11
  • All versions prior to 16.15
  • All versions prior to 15.19
  • All versions prior to 14.24

CloudNativePG

  • All operand versions prior to 18.5
  • All operand versions prior to 17.11
  • All operand versions prior to 16.15
  • All operand versions prior to 15.19
  • All operand versions prior to 14.24

WarehousePG

  • All 6.x versions up to and including 6.27.5
  • All 7.x versions up to and including 7.5.0

Remediation/fixes

PostgreSQL

Affected VersionFixed InFix Published
prior to 18.518.52026-08-13
prior to 17.1117.112026-08-13
prior to 16.1516.152026-08-13
prior to 15.1915.192026-08-13
prior to 14.2414.242026-08-13

EDB Postgres Extended Server

Affected VersionFixed InFix Published
prior to 18.518.52026-08-13
prior to 17.1117.112026-08-13
prior to 16.1516.152026-08-13
prior to 15.1915.192026-08-13
prior to 14.2414.242026-08-13

EDB Postgres Advanced Server

Affected VersionFixed InFix Published
prior to 18.518.52026-08-13
prior to 17.1117.112026-08-13
prior to 16.1516.152026-08-13
prior to 15.1915.192026-08-13
prior to 14.2414.242026-08-13

CloudNativePG

Customer should update to the fixed version of the PostgreSQL operands.

WarehousePG

Fixes will be included in the next minor release of WarehousePG 6.x and 7.x.

References

Acknowledgement

Source: PostgreSQL.org


Could this page be better? Report a problem or suggest an addition!