← Back to CVE List
CVE-2026-6637NVD
Vulnerability Summary
Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
CVSS v3.1 Base Metrics — Score 8.8 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected & Patched Versions
- Postgresql Postgresql < 14.23
- Postgresql Postgresql >= 15.0 and < 15.18
- Postgresql Postgresql >= 16.0 and < 16.14
- Postgresql Postgresql >= 17.0 and < 17.10
- Postgresql Postgresql >= 18.0 and < 18.4
- Postgresql Postgresql 14.23
- Postgresql Postgresql 15.18
- Postgresql Postgresql 16.14
- Postgresql Postgresql 17.10
- Postgresql Postgresql 18.4