CVE-2026-6477: PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-14 · updated 2026-08-25
Weakness: CWE-242

Description

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Affected products

PostgreSQL: before 14.23; from 15.0 before 15.18; from 16.0 before 16.14; from 17.0 before 17.10; from 18.0 before 18.4 — fixed in 14.23, 15.18, 16.14, 17.10, 18.4

How to fix

Upgrade to a fixed version: PostgreSQL 14.23, 15.18, 16.14, 17.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-6477 or the next vulnerability affects your stack