PostgreSQL CVE-2026-14664

Exploitation requires a valid PostgreSQL database account with sufficient privilege to issue SQL queries - specifically PR:L (any authenticated query author, not superuser). The flaw is triggered specifically when text input processed through the pg_wchar internal encoding layer undergoes unanticipated growth during regexp evaluation, bypassing the encoding validation check; no non-default configuration or special database feature must be enabled, as regular expression support is available in all default PostgreSQL installations. Network connectivity to the PostgreSQL service port (default TCP 5432) is required unless exploitation occurs from a locally connected session. Exploitation is bounded by the need for at least one valid database credential; unauthenticated exploitation is not possible per the PR:L CVSS vector. The scope of impact is limited to the database host (S:U) - lateral movement beyond the server requires additional exploitation of OS-level or local privilege escalation paths.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-accessible, low-complexity exploit requiring only a low-privileged database credential, with full confidentiality, integrity, and availability impact on the database server. The PR:L requirement is significant: exploitation does not require superuser or DBA-level privileges - any valid query author, including compromised application service accounts, is a viable attack vector. No EPSS score was present in the intelligence data, preventing probability-of-exploitation quantification, and no CISA KEV listing exists, so confirmed active exploitation is not established. Without scope change (S:U), impact is bounded to the database host itself, but OS-level code execution as the postgres process user represents a severe compromise of the underlying system. The low attack complexity and absence of user interaction mean that exploitation is automatable once a credential is obtained, and even a mid-sized municipal IT team in walbrzych managing a standard PostgreSQL deployment should treat this as urgent patching rather than a deferred maintenance item. The CVSS score and technical description are internally consistent; no conflicting signals are observed between the vector and the described exploitation mechanism.

An attacker holding a compromised application-tier PostgreSQL credential connects to the database over the network and submits a SQL query invoking a regular expression against a carefully crafted text value that bypasses initial encoding validation but expands during pg_wchar round-trip conversion, overflowing the regexp engine's heap buffer. The overflow corrupts adjacent heap metadata, allowing the attacker to redirect execution and run arbitrary code as the OS user owning the PostgreSQL process - typically the unprivileged postgres system account, which nonetheless has full access to all database files and may have further local privilege escalation paths. No public proof-of-concept has been identified at time of analysis, though the deterministic, low-complexity nature of the trigger path suggests weaponization would be accessible to a skilled attacker.