PostgreSQL plperl CVE-2026-14670

Exploitation requires that: (1) the plperl procedural language is installed and enabled in the target PostgreSQL database ('CREATE EXTENSION plperl' or equivalent has been executed); (2) the attacker holds a database account with the USAGE privilege on the plperl language and the right to CREATE FUNCTION or own an existing plperl function - this is a low-privilege database role, not superuser; (3) the attacker can cause that function to be executed (either by calling it directly or by having it triggered). Exploitation is limited by the requirement for a valid database credential and plperl enablement, which is not a default configuration on all PostgreSQL deployments. The attack does not require superuser or administrative database privileges, and no user interaction beyond normal database connectivity is required per the CVSS vector (UI:N).

The CVSS base score of 8.8 (High) is well-supported by the vector: network-accessible, low complexity, low privilege required, with full confidentiality, integrity, and availability impact. The key limiting factor is PR:L - an attacker must hold a database account with permission to create or own plperl functions, which is not the default for all roles. However, in shared-hosting databases, multi-tenant environments, or deployments where developers have CREATE FUNCTION rights, this prerequisite is easily satisfied. The CWE-122 class (heap overflow leading to RCE) is historically exploitable when memory allocators are predictable, though reliability varies. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified. The vulnerability is not in the CISA KEV catalog and no POC has been publicly identified at time of analysis, which tempers urgency somewhat relative to the raw CVSS score. Nonetheless, given the OS-level code execution impact and the breadth of affected versions across four major release lines, any organization running plperl-enabled PostgreSQL instances - even a mid-sized municipal IT team in walbrzych would find this difficult to dismiss - should treat patching as a near-term priority rather than routine maintenance.

An attacker with a low-privilege PostgreSQL account - such as a developer credential in a shared database environment - creates or controls a plperl function whose body returns a Perl tied hash object. When the function is called, the plperl return-value handler overflows the heap, potentially allowing the attacker to overwrite function pointers or control structures and redirect execution to shellcode or a ROP chain running as the OS 'postgres' user. No public POC has been identified at time of analysis, so reliable exploitation likely requires custom exploit development targeting the specific PostgreSQL build and OS allocator.