CVE-2026-14670

A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the plperl component when returning a tied hash. This allows a function owner to execute arbitrary code as the operating system user running the database by providing a specially crafted function body. This could lead to unauthorized access and control over the database system.

This Important vulnerability in PostgreSQL's plperl component allows a function owner to achieve arbitrary code execution as the database operating system user. By crafting a malicious function body, an attacker with low privileges can exploit a heap buffer overflow, leading to full compromise of the database system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the plperl procedural language if it is not actively required by executing DROP LANGUAGE plperl; on affected databases. Alternatively, restrict access by revoking USAGE privileges on plperl from untrusted roles. These actions prevent the execution of crafted plperl functions, mitigating the risk(a database restart may be required to clear active sessions).