PostgreSQL CVE-2026-14680

Exploitation requires exactly one prerequisite: a valid PostgreSQL database login of any privilege level, including accounts granted only SELECT on specific tables or minimal default privileges. No superuser rights, database ownership, schema permissions, or specific PostgreSQL features need to be enabled - the vulnerable code path exists in the core function-call dispatch mechanism present in all standard PostgreSQL configurations. The CVSS vector AV:N/AC:L/PR:L/UI:N confirms that the attack is network-accessible, requires no race conditions or environmental dependencies, and needs no victim interaction beyond the attacker's own SQL session. Exploitation is bounded by the following limiting factors: (1) the attacker must hold at least one set of valid database credentials, preventing fully unauthenticated exploitation; and (2) the resulting code execution is constrained to the privilege level of the PostgreSQL OS process user rather than root, unless that user has been incorrectly granted elevated OS permissions. No non-default configuration, specific extension, or particular deployment mode is required to reach the vulnerable code path.

The CVSS 8.8 score accurately reflects the severity of this vulnerability: any low-privileged authenticated user reachable over the network can achieve full OS-level code execution with no race conditions or special configurations required. The PR:L designation is particularly significant - the threat surface includes every database account, not just superusers, meaning application service accounts, reporting users, and any other minimal-grant principals are all viable attacker entry points. No EPSS data was included in the provided intelligence, so exploitation probability cannot be quantitatively assessed; the vulnerability is not currently listed in the CISA KEV catalog, and no POC exploit code was identified, meaning active exploitation has not been publicly confirmed. Despite the absence of confirmed in-the-wild abuse, even a mid-sized municipal IT team in leszno should treat this as urgent, given that any database credential - including those held by third-party application accounts - is sufficient to escalate to host OS access. The scope metric S:U formally constrains the blast radius to the PostgreSQL process, but OS-level code execution within that process provides sufficient footing to pivot to host file systems, adjacent credentials, and network services. The combination of low privilege requirement, network accessibility, and low attack complexity makes this a genuine priority rather than a theoretical high-CVSS-but-low-real-risk scenario.

An attacker holding a low-privileged PostgreSQL account - for example, a read-only reporting credential or an application service account with limited grants - connects to the database over the network and issues a crafted SQL call targeting a C-language function that declares an 'internal' argument type. The incomplete type-enforcement check allows the call to proceed, causing the backend process to misinterpret the supplied argument as an internal data structure, corrupting heap memory in the PostgreSQL process. With controlled corruption, the attacker achieves arbitrary code execution as the OS user running PostgreSQL (typically 'postgres'), gaining access to all database files, OS-level credentials accessible to that user, and potential pivot paths to other systems on the same host network.