CVE-2026-6575: postgresql Buffer Over-read
Vulnerability summary
CVE-2026-6575 is a medium (CVSS 4.3) Buffer Over-read vulnerability in postgresql. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7 · Related 3Timeline
- 14-05-2026PublishedVulnerability first disclosed.
- 14-05-2026Last modifiedVulnerability information updated.
Description
Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major version 18, minor versions before PostgreSQL 18.4 are affected. Versions before PostgreSQL 18 are unaffected.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
10%
Versus all other CVEs
30-day change
0.00 pp
From 0.21% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu8 products
- postgresql-10All versions (No fix recorded)
- postgresql-12All versions (No fix recorded)
- postgresql-14< 14.23-0ubuntu0.22.04.1
- postgresql-16< 16.14-0ubuntu0.24.04.1
- postgresql-17< 17.10-0ubuntu0.25.10.1
Alpine1 product
- postgresql18< 18.4-r0
Debian1 product
- postgresql-18< 18.4-1
Postgresql1 product
- postgresql≥ 18.0, < 18.4
4 vendors · 11 products
