CVE-2026-6464

A flaw was found in PostgreSQL psql. During the COPY FROM STDIN operation, untrusted data can be mistakenly interpreted as psql commands if an error injection causes the command to fail prematurely. This could allow an attacker to achieve arbitrary command execution. Successful exploitation requires the attacker to control both the server and the data being copied, or to leverage a coincidental error while controlling only the data.

This is an Important flaw in the PostgreSQL psql client that could lead to arbitrary command execution. When using COPY FROM STDIN, untrusted data can be processed as psql commands if an error injection causes the command to fail prematurely. Exploitation requires an attacker to control both the PostgreSQL server and the data rows, or to leverage a coincidental error, which significantly limits the attack surface in typical Red Hat deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.