CVEFinder.io

CVE-2026-6637

⚠️ high
🔍 Scan for this CVE
Summary

Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Vers

Description

Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

CVSS Score
8.8
High
EPSS Score
0.0
Exploit Probability
Published Date
2026-05-14
First Seen: 2026-05-17
📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 80.8% of all 360,729 vulnerabilities in our database.

#69,284
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: May 14, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
The PostgreSQL project thanks Nikolay Samokhvalov for reporting this problem.
SSVC data provided by CISA
Last Modified 2026-05-18
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)

📦 Affected Products 5

🔗 References 1

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-14662 ⚠️ high 8.8 0.5 Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause ... 2026-08-13
CVE-2026-14663 🔶 medium 6.5 0.1 Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of ... 2026-08-13
CVE-2026-14664 ⚠️ high 8.8 0.4 Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user... 2026-08-13
CVE-2026-14666 🔶 medium 4.2 0.2 Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query ... 2026-08-13
CVE-2026-14668 ⚠️ high 8.1 0.3 Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a cal... 2026-08-13
CVE-2026-14669 ⚠️ high 8.8 0.6 Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code... 2026-08-13
These CVEs affect the same products