PostgreSQL Patches 28 Flaws Including Multiple High-Severity RCE Bugs

PostgreSQL has released security updates for all supported branches after fixing 28 vulnerabilities, including several high-severity flaws that could lead to remote code execution or full compromise of database instances. Patched versions are 14.24, 15.19, 16.15, 17.11, and 18.6. Among the most serious issues are CVE-2026-14662, an out-of-bounds write involving the tsvector and tsquery data types, and CVE-2026-18408, which can enable code execution during the database restore process.

Additional high-impact bugs disclosed in the same release include CVE-2026-14669, a heap buffer overflow in to_char(timestamptz) triggered by long POSIX timezone abbreviations and rated CVSS 8.8, and CVE-2026-14679, an argument-matching flaw that permits controlled out-of-bounds writes on the stack and carries a CVSS 8.2 score. Successful exploitation of these vulnerabilities could allow attackers to execute code as the operating-system user running PostgreSQL. PostgreSQL said it had no reports of active exploitation at publication time and also warned that support for PostgreSQL 14 ends on November 12, 2026, after which it will no longer receive security fixes.