Critical PostgreSQL Flaws Allow Code Execution, SQL Injection

Key Takeaways

• The PostgreSQL Global Development Group has released critical security updates addressing 11 vulnerabilities.
• These flaws include arbitrary code execution, multiple SQL injection issues, memory corruption, and client-side risks.
• All supported PostgreSQL branches (versions 14 through 18) are affected, necessitating immediate patching.
• Affected versions include 18.4, 17.10, 16.14, 15.18, and 14.23.

The PostgreSQL Global Development Group has issued urgent security updates to address 11 vulnerabilities across all actively supported database versions. These patches resolve critical flaws, including arbitrary code execution and several SQL injection vulnerabilities, which could lead to severe compromises.

The new minor versions — PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 — are now available. Beyond the security fixes, these releases also incorporate over 60 bug resolutions, making them essential for maintaining robust production database environments.

It is crucial for administrators to understand that all supported branches, from version 14 up to 18, are impacted by at least some of these issues. Simply running a newer major version does not inherently eliminate the risk. The upgrade process for these minor updates is straightforward: administrators can halt PostgreSQL, update the binaries in place, and restart the service. Complex procedures like dump/restore or pg_upgrade are not required.

PostgreSQL Vulnerabilities Detailed

Code Execution via refint Module

Among the most severe vulnerabilities is CVE-2026-6637, found within the refint module, which is responsible for enforcing referential integrity. This flaw is a stack buffer overflow that permits an unprivileged database user to execute arbitrary code. The code runs with the privileges of the operating system account managing PostgreSQL, potentially leading to a full server compromise from an initial database-level foothold.

Another attack vector associated with refint arises when an application exposes a user-controlled column as a primary key with a refint-cascade property and allows user updates. In such a scenario, a maliciously crafted primary key update can trigger an SQL injection, enabling the attacker to execute arbitrary SQL commands with the database privileges of the updating role.

SQL Injection in Replication Components

Multiple SQL injection pathways have been identified within PostgreSQL’s logical replication features, which attackers could exploit for privilege escalation.

CVE-2026-6476 impacts pg_createsubscriber. It enables an attacker with pg_create_subscription rights to inject SQL commands that execute with superuser privileges when pg_createsubscriber is invoked.

Additionally, CVE-2026-6638 is present in the ALTER SUBSCRIPTION … REFRESH PUBLICATION command. A subscriber table creator can craft malicious table names, causing arbitrary SQL to execute with the publication side’s credentials when REFRESH PUBLICATION is next run. These specific vulnerabilities primarily affect PostgreSQL 16–18 environments that utilize logical replication.

Other Critical Memory and Client-Side Issues

The updates also address several vulnerabilities related to memory safety, potential denial-of-service, and client-side tools.

CVE-2026-6473 describes integer wraparound problems that can result in undersized memory allocations and subsequent out-of-bounds writes. This can trigger segmentation faults when attackers provide specially crafted inputs.

CVE-2026-6477 affects the libpq client library, specifically through unsafe usage of PQfn in large-object helper functions such as lo_export() and lo_read(). A server superuser could send oversized responses that overwrite stack memory in client tools like psql and pg_dump, potentially leading to client-side code execution.

Backup utilities are also at risk. CVE-2026-6475 allows pg_basebackup (in plain format) and pg_rewind to follow symbolic links. This could enable a malicious origin superuser to overwrite arbitrary local files, such as shell profiles, on the backup system.

It is also important to note that PostgreSQL 14 is slated to reach its end-of-life on November 12, 2026, after which it will no longer receive security fixes. Organizations still operating on version 14 should apply the 14.23 update immediately and begin planning a migration to a newer, supported branch.

Given the severe nature of these vulnerabilities, which range from code execution and SQL injection to memory corruption and client-side risks, these updates are considered urgent. This is particularly true for PostgreSQL deployments that are internet-exposed or serve multiple tenants.

What You Should Do

• Immediately upgrade all PostgreSQL installations to the latest patched versions: 18.4, 17.10, 16.14, 15.18, or 14.23.
• Review and harden configurations related to the refint module, especially in applications that allow user-controlled primary key updates.
• Assess the use of logical replication features, particularly in PostgreSQL 16-18 environments, and ensure strict access controls for users with pg_create_subscription rights.
• Update all client tools, such as psql and pg_dump, to their latest versions to mitigate client-side code execution risks.
• For PostgreSQL 14 users, apply version 14.23 and initiate a migration plan to a currently supported major version before its end-of-life on November 12, 2026.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.