CVE-2026-14671

Published: Aug 13, 2026Modified: Aug 29, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 (Secondary)

Description

Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Affected (5)

Products: Postgresql: Postgresql

Postgresql

1 product

Postgresql

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Postgresql Postgresql	From 14.0 to 14.24
Postgresql Postgresql	From 15.0 to 15.19
Postgresql Postgresql	From 16.0 to 16.15
Postgresql Postgresql	From 17.0 to 17.11
Postgresql Postgresql	From 18.0 to 18.5

Related CWEs

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

References (1)

https://www.postgresql.org/support/security/CVE-2026-14671/

Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Vendor Advisory

Timeline

No history available yet.