CVE-2026-14676

A flaw was found in PostgreSQL pg_stat_statements. A local attacker, specifically a query author, could exploit a heap buffer overflow vulnerability by crafting special queries containing array constants. This could allow the attacker to execute arbitrary code as the operating system user running the database, leading to a complete compromise of the database system.

An Important heap buffer overflow flaw was identified in the PostgreSQL pg_stat_statements extension. This vulnerability allows an authenticated database user to execute arbitrary code as the database's operating system user by submitting specially crafted SQL queries. The pg_stat_statements extension must be loaded (via shared_preload_libraries) for the vulnerability to be exploitable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If upgrading to PostgreSQL 18.5 or later is not immediately possible, the pg_stat_statements extension can be disabled as a workaround. Remove 'pg_stat_statements' from the shared_preload_libraries parameter in postgresql.conf and restart the PostgreSQL service. This disables query statistics tracking but fully eliminates the attack surface for this vulnerability, as the heap buffer overflow exists exclusively within the pg_stat_statements query-normalization code path and is not reachable when the extension is not loaded. Additionally, limiting database access to trusted, vetted users reduces exposure, though it does not eliminate the risk for any authenticated user who can submit arbitrary queries.