Loading vulnerability…
Stack Buffer Overflow in PostgreSQL OUT Parameter Argument Matching
CVE-2026-14679 is a stack-based buffer overflow in PostgreSQL argument-name matching. An object creator can trigger the overflow by manipulating the OUT parameter count, causing out-of-bounds stack writes restricted to byte values 0x00 and 0x01. The precise consequences of this restricted memory corruption are unknown. Affected releases include PostgreSQL versions before 18.6, 17.11, 16.15, 15.19, and 14.24 within their respective major-version branches.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation corrupts stack memory through writes limited to 0x00 and 0x01. The precise operational impact remains unknown. Vulnerability-specific severity metadata assesses high availability impact, low integrity impact, and no confidentiality impact, but arbitrary code execution, privilege escalation, and information disclosure are not established.
If you can’t patch tonight, do this now.
Until updates are deployed, restrict PostgreSQL access to trusted users and networks and limit untrusted users' ability to create database objects. These measures reduce exposure but are not a confirmed workaround for the overflow. No vulnerability-specific temporary workaround is documented.
Patch, then assume compromise.
Upgrade to PostgreSQL 18.6, 17.11, 16.15, 15.19, or 14.24, or a later release in the corresponding branch. Alternatively, install the distribution's security-fixed PostgreSQL packages. Ubuntu fixes include 18.6-0ubuntu0.26.04.1, 16.15-0ubuntu0.24.04.1, and 14.24-0ubuntu0.22.04.1; Debian trixie provides postgresql-17 version 17.11-0+deb13u1. Restart PostgreSQL after updating to ensure the patched server is running.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
73 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.