CVE-2026-6477: postgresql Use of Inherently Dangerous Function
Vulnerability summary
CVE-2026-6477 is a high (CVSS 8.8) Use of Inherently Dangerous Function vulnerability in postgresql. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 38.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 47 · Related 15Timeline
- 14-05-2026PublishedVulnerability first disclosed.
- 25-08-2026Last modifiedVulnerability information updated.
Description
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated8.4HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated8.4HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.45%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
0.00 pp
From 0.45% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-242Use of Inherently Dangerous FunctionThe product calls a function that can never be guaranteed to work safely.
- CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
Affected systems
Ubuntu8 products
- postgresql-10All versions (No fix recorded)
- postgresql-12All versions (No fix recorded)
- postgresql-14< 14.23-0ubuntu0.22.04.1
- postgresql-16< 16.14-0ubuntu0.24.04.1
- postgresql-17< 17.10-0ubuntu0.25.10.1
Redhat5 products
- libpq< 0:13.23-3.el9_8 | < 0:16.14-1.el10_2 | < 0:13.23-1.el8_6.1 | < 0:13.23-1.el9_2.1 | < 0:13.23-1.el9_4.1 | < 0:13.23-1.el9_6.1 | < 0:16.14-0.el10_0.1
- libpq-debuginfo< 0:13.23-3.el9_8 | < 0:16.14-1.el10_2 | < 0:13.23-1.el8_6.1 | < 0:13.23-1.el9_2.1 | < 0:13.23-1.el9_4.1 | < 0:13.23-1.el9_6.1 | < 0:16.14-0.el10_0.1
- libpq-debugsource< 0:13.23-3.el9_8 | < 0:16.14-1.el10_2 | < 0:13.23-1.el8_6.1 | < 0:13.23-1.el9_2.1 | < 0:13.23-1.el9_4.1 | < 0:13.23-1.el9_6.1 | < 0:16.14-0.el10_0.1
- libpq-devel< 0:13.23-3.el9_8 | < 0:16.14-1.el10_2 | < 0:13.23-1.el8_6.1 | < 0:13.23-1.el9_2.1 | < 0:13.23-1.el9_4.1 | < 0:13.23-1.el9_6.1 | < 0:16.14-0.el10_0.1
- libpq-devel-debuginfo< 0:13.23-3.el9_8 | < 0:16.14-1.el10_2 | < 0:13.23-1.el8_6.1 | < 0:13.23-1.el9_2.1 | < 0:13.23-1.el9_4.1 | < 0:13.23-1.el9_6.1 | < 0:16.14-0.el10_0.1
Alpine4 products
- postgresql15< 15.18-r0
- postgresql16< 16.14-r0
- postgresql17< 17.10-r0
- postgresql18< 18.4-r0
Debian3 products
- postgresql-15< 15.18-0+deb12u1
- postgresql-17< 17.10-0+deb13u1
- postgresql-18< 18.4-1
Postgresql1 product
- postgresql< 14.23 | ≥ 15.0, < 15.18 | ≥ 16.0, < 16.14 | ≥ 17.0, < 17.10 | ≥ 18.0, < 18.4
5 vendors · 21 products
