PostgreSQL CVE-2026-14679

Exploitation requires the attacker to hold CREATE privilege within at least one PostgreSQL database, enabling them to define functions or stored procedures with manipulated OUT parameter counts. This is an authenticated, privilege-gated condition - anonymous or unprivileged database connections cannot trigger the vulnerable code path. The overflow is further constrained to writing only 0x0 (null) and 0x1 bytes, which limits the achievable impact to process crashes and low-level stack corruption rather than arbitrary memory writes or code execution. The vulnerability is present in default PostgreSQL installations but is NOT exploitable by unauthenticated network attackers despite the NVD CVSS PR:N rating - the 'object creator' prerequisite confirmed in the description represents a meaningful limiting factor. Environments where CREATE privilege is restricted to DBAs or application deployment pipelines have a significantly reduced attack surface.

The provided CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, score 8.2) contains a notable conflict: PR:N implies no authentication or privilege is required, yet the description explicitly names 'an object creator' as the threat actor - creating functions or procedures in PostgreSQL requires at minimum CREATE privilege on a database, corresponding to PR:L. This mismatch likely inflates the base score by approximately 0.5-0.8 points. No EPSS score was provided, and the CVE has no CISA KEV listing and no known POC, placing exploitation status at unconfirmed. The constrained write primitive (0x0/0x1 only) substantially reduces the probability of achieving code execution; the dominant realistic impact is a backend process crash (DoS) for the session executing the malformed object definition. Real-world priority is moderate-to-high for organizations running untrusted users with CREATE privileges; lower for environments where object creation is tightly controlled. CVSS indicates network vector but the 'object creator' prerequisite implies authenticated database access - defenders should verify the actual privilege boundary with the PostgreSQL security team before relying on the NVD PR:N rating.

An authenticated PostgreSQL user who holds CREATE privilege on a database defines a function or procedure with a specially crafted OUT parameter count designed to overflow the argument name matching buffer on the backend's stack. The backend writes controlled 0x0 or 0x1 bytes into adjacent stack memory, corrupting internal state and causing the server process handling that session to crash, resulting in a denial of service for that connection. No public POC exists at time of analysis; the constrained write primitive makes escalation beyond availability loss unlikely without additional primitives.