PostgreSQL fixes high-severity flaws enabling code execution and SQL injection

PostgreSQL released security updates for supported branches to fix multiple high-severity vulnerabilities affecting versions before 14.23, 15.18, 16.14, 17.10, and 18.4. The most serious issues include CVE-2026-6473, an integer wraparound bug that can cause undersized allocations and out-of-bounds writes, and CVE-2026-6637, a flaw in the refint module that can lead to a stack buffer overflow. In both cases, an unprivileged database user may be able to achieve arbitrary code execution as the operating system account running PostgreSQL.

The refint issue also exposes a separate SQL injection path when applications use a user-controlled column as a refint cascade primary key and allow user-controlled updates, potentially enabling arbitrary SQL execution as the database user performing the update. Debian issued security advisories for postgresql-15 and postgresql-17, and the Canadian Centre for Cyber Security urged administrators to review PostgreSQL’s advisory and deploy the patched releases 14.23, 15.18, 16.14, 17.10, and 18.4.