VulnerabilityModified

CVE-2026-14671

Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database.

HIGH 8.8EPSS 0.42%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.42%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.42% probability · 36th percentile
CISA KEV: Not listed
Weakness: CWE-843
Affected: postgresql/postgresql
Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

References

https://www.postgresql.org/support/security/CVE-2026-14671/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.