{"id":"CVE-2026-6477","title":"Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-l…","summary":"Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-l…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-242","CWE-120"],"vendor":"postgresql","product":"postgresql","affected":["postgresql < 14.23","postgresql >= 15.0, < 15.18","postgresql >= 16.0, < 16.14","postgresql >= 17.0, < 17.10","postgresql >= 18.0, < 18.4"],"patched":["postgresql 18.4"],"published":"2026-05-14","updated":"2026-06-30","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6477","references":[{"url":"https://www.postgresql.org/support/security/CVE-2026-6477/","label":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"},{"url":"https://access.redhat.com/errata/RHSA-2026:21182","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22878","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26181","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26203","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26204","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26524","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26525","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26561","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27718","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27738","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27741","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27742","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27743","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:28037","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:29212","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:29815","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:29904","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:29953","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:32983","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:32994","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33441","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-6477","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477442","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6477.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6477"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6477"},{"url":"https://access.redhat.com/errata/RHSA-2026:49521"},{"url":"https://access.redhat.com/errata/RHSA-2026:50863"},{"url":"https://access.redhat.com/errata/RHSA-2026:44391"},{"url":"https://access.redhat.com/errata/RHSA-2026:28999"},{"url":"https://access.redhat.com/errata/RHSA-2026:28208"},{"url":"https://access.redhat.com/errata/RHSA-2026:28143"},{"url":"https://access.redhat.com/errata/RHSA-2026:44420"},{"url":"https://access.redhat.com/errata/RHSA-2026:34362"},{"url":"https://access.redhat.com/errata/RHSA-2026:34363"},{"url":"https://access.redhat.com/errata/RHSA-2026:47090"},{"url":"https://access.redhat.com/errata/RHSA-2026:35880"},{"url":"https://access.redhat.com/errata/RHSA-2026:34043"},{"url":"https://access.redhat.com/errata/RHSA-2026:42555"},{"url":"https://access.redhat.com/errata/RHSA-2026:49908"},{"url":"https://access.redhat.com/errata/RHSA-2026:33497"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00454,"epssPercentile":0.39261,"ingestedAt":"2026-07-01T09:50:45.701Z","scores":{"nvd":8.8,"vendor":8.4},"slug":"CVE-2026-6477","body":"## Overview\n\nUse of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response.  Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size.  Because both the \\lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.\n\n## Affected\n\n- `postgresql < 14.23`\n- `postgresql >= 15.0, < 15.18`\n- `postgresql >= 16.0, < 16.14`\n- `postgresql >= 17.0, < 17.10`\n- `postgresql >= 18.0, < 18.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `postgresql 18.4`\n\n## Vendor advisories\n\n- **RHSA-2026:49521** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS) · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49521)\n- **RHSA-2026:50863** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50863)\n- **RHSA-2026:27718** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:27718)\n- **RHSA-2026:44391** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:44391)\n- **RHSA-2026:27743** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:27743)\n- **RHSA-2026:27742** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:27742)\n- **RHSA-2026:27738** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:27738)\n- **RHSA-2026:28999** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-06-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:28999)\n- **RHSA-2026:28208** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-06-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:28208)\n- **RHSA-2026:26181** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-06-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:26181)\n- **RHSA-2026:28143** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-06-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:28143)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Self-service automation portal 2 · no fix planned: Red Hat Enterprise Linux 6, Self-service automation portal 2 · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6477.json)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}