CVE-2026-14676 - PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code

First Published: 2026/08/13

Important: This assessment evaluates the impact of CVE-2026-14676 on EDB products and services. It links to and details the CVE and supplements that information with EDB's own assessment.

Summary

A heap buffer overflow in the PostgreSQL pg_stat_statements contrib module allows an authenticated user to execute arbitrary code with the privileges of the operating system user running the database, via crafted queries containing array constants. This vulnerability only affects PostgreSQL 18.x; versions before PostgreSQL 18.5 are affected. PostgreSQL 17 and earlier are not affected.

Vulnerability details

CVE-ID: CVE-2026-14676

CVE Publish Date: 2026/08/13

CVSS Base Score: 8.8

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products and versions

PostgreSQL

• All versions prior to 18.5

Versions prior to 18.0 are not affected.

EnterpriseDB Postgres Advanced Server (EPAS)

• All versions prior to 18.5

EnterpriseDB Postgres Extended (PGE)

• All versions prior to 18.5

CloudNativePG

• All operand versions prior to 18.5

Operand versions prior to 18.0 are not affected.

Remediation/fixes

PostgreSQL

EDB Postgres Extended Server

EDB Postgres Advanced Server

CloudNativePG

Customer should update to the fixed version of the PostgreSQL operands.

References

• CVSS Calculator v3.1
• NVD - CVE-2026-14676 Detail
• https://www.postgresql.org/support/security/CVE-2026-14676/

Related information

• EnterpriseDB
• EDB Blogs link

Acknowledgement

Source: PostgreSQL.org