PostgreSQL CVE-2026-14676

Exploitation requires a valid PostgreSQL database account with sufficient privilege to execute SQL queries - corresponding to PR:L in the CVSS vector. The pg_stat_statements extension must be active, which requires it to be listed in the shared_preload_libraries configuration parameter and loaded at server startup; while not enabled by default in a bare PostgreSQL installation, it is extremely commonly enabled in production environments for performance monitoring. The affected deployment must be running PostgreSQL major version 18 with a minor version below 18.5 - all pre-version-18 installations are explicitly unaffected per vendor statement. Network connectivity to the PostgreSQL port (default TCP 5432) is required per AV:N. No special OS-level access, DBA role, or superuser privilege is needed for initial exploitation. Exploitation is limited by the requirement for database authentication; unauthenticated remote attackers cannot trigger this flaw.

The CVSS 8.8 score is well-supported by the vector metrics: network-accessible (AV:N), low complexity (AC:L), low-privilege authentication required (PR:L), no user interaction (UI:N), and full C/H/I/H/A/H impact. The PR:L requirement is the primary limiting factor - exploitation demands a valid database account - but in multi-tenant environments, shared hosting platforms, or any deployment where developers or analysts hold query privileges, this is a realistic attacker precondition. No EPSS data was provided in the source intelligence, and the CVE is not currently in the CISA KEV catalog, so confirmed in-the-wild exploitation cannot be asserted; however, the heap-overflow-to-RCE class is well-understood and historically weaponizable with moderate effort once a root cause is published. The fix version (18.5) is clearly defined by the vendor, meaning the remediation path is unambiguous. Given that pg_stat_statements is commonly enabled in production deployments for performance monitoring, even a mid-sized municipal IT team in kielce running PostgreSQL 18 for internal applications should treat this as urgent and schedule patching within their next maintenance window rather than deferring to a quarterly cycle. The absence of a KEV listing or known POC moderately reduces urgency compared to a fully weaponized flaw, but the severity and clarity of impact warrant prioritized patching over lower-scored issues.

An attacker with a low-privilege database account (e.g., a developer credential, a compromised application service account, or a shared analytics user) connects to the PostgreSQL 18.x instance over the network and submits a crafted SQL query embedding a malformed array constant specifically designed to overflow a heap buffer within the pg_stat_statements extension during query normalization or statistics recording. The overflow corrupts adjacent heap memory, enabling the attacker to redirect execution flow and run arbitrary code as the 'postgres' OS user, achieving full control of the database host process. No public proof-of-concept exploit has been identified at time of analysis, but the attack primitive is a well-studied class.