CVE-2026-6477 in PostgreSQL 18.*

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or

Severity

High 8.8

Exploitation

0% chance of exploit
in the next 30 days

Fix

Update to 18.4

Where

Workstation tool

How it matched

Version line match

First seen

2026-11-05 01:13:58 UTC

Source

https://nvd.nist.gov/vuln/detail/CVE-2026-6477