--- id: CVE-2026-6477 title: >- Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-l… summary: >- Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-l… severity: high cvss: 8.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H' cwe: - CWE-242 - CWE-120 vendor: postgresql product: postgresql affected: - postgresql < 14.23 - 'postgresql >= 15.0, < 15.18' - 'postgresql >= 16.0, < 16.14' - 'postgresql >= 17.0, < 17.10' - 'postgresql >= 18.0, < 18.4' patched: - postgresql 18.4 published: '2026-05-14' updated: '2026-06-30' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-6477' references: - url: 'https://www.postgresql.org/support/security/CVE-2026-6477/' label: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 - url: 'https://access.redhat.com/errata/RHSA-2026:21182' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:22878' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26181' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26203' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26204' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26524' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26525' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26561' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27718' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27738' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27741' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27742' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27743' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:28037' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:29212' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:29815' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:29904' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:29953' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:32983' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:32994' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33441' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-6477' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2477442' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6477.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-6477' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-6477' - url: 'https://access.redhat.com/errata/RHSA-2026:49521' - url: 'https://access.redhat.com/errata/RHSA-2026:50863' - url: 'https://access.redhat.com/errata/RHSA-2026:44391' - url: 'https://access.redhat.com/errata/RHSA-2026:28999' - url: 'https://access.redhat.com/errata/RHSA-2026:28208' - url: 'https://access.redhat.com/errata/RHSA-2026:28143' - url: 'https://access.redhat.com/errata/RHSA-2026:44420' - url: 'https://access.redhat.com/errata/RHSA-2026:34362' - url: 'https://access.redhat.com/errata/RHSA-2026:34363' - url: 'https://access.redhat.com/errata/RHSA-2026:47090' - url: 'https://access.redhat.com/errata/RHSA-2026:35880' - url: 'https://access.redhat.com/errata/RHSA-2026:34043' - url: 'https://access.redhat.com/errata/RHSA-2026:42555' - url: 'https://access.redhat.com/errata/RHSA-2026:49908' - url: 'https://access.redhat.com/errata/RHSA-2026:33497' tags: - nvd - csaf - vex - red-hat epss: 0.00454 epssPercentile: 0.39261 ingestedAt: '2026-07-01T09:50:45.701Z' scores: nvd: 8.8 vendor: 8.4 --- ## Overview Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected. ## Affected - `postgresql < 14.23` - `postgresql >= 15.0, < 15.18` - `postgresql >= 16.0, < 16.14` - `postgresql >= 17.0, < 17.10` - `postgresql >= 18.0, < 18.4` ## Remediation Upgrade past the affected range: - `postgresql 18.4` ## Vendor advisories - **RHSA-2026:49521** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS) · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49521) - **RHSA-2026:50863** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50863) - **RHSA-2026:27718** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:27718) - **RHSA-2026:44391** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:44391) - **RHSA-2026:27743** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:27743) - **RHSA-2026:27742** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:27742) - **RHSA-2026:27738** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:27738) - **RHSA-2026:28999** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-06-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:28999) - **RHSA-2026:28208** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-06-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:28208) - **RHSA-2026:26181** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-06-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:26181) - **RHSA-2026:28143** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-06-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:28143) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Self-service automation portal 2 · no fix planned: Red Hat Enterprise Linux 6, Self-service automation portal 2 · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6477.json)