CVE-2026-6477: PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory
Last updated 22 May 2026
Other sources
PostgreSQL libpq lo functions let server superuser overwrite client stack memory
— Microsoft
Use of inherently dangerous function PQfn(..., resultisint=0, ...) in PostgreSQL libpq loexport(), loread(), lolseek64(), and lotell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., resultisint=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \loexport command in psql and pgdump call loread(), the server superuser can overwrite pgdump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6477?
CVE-2026-6477 has a critical severity rating due to potential exploitation by a server superuser to overwrite client stack memory.
How do I fix CVE-2026-6477?
To fix CVE-2026-6477, update PostgreSQL to a version higher than 18.4, 17.10, 16.14, 15.18, or 14.23.
Who is affected by CVE-2026-6477?
CVE-2026-6477 affects users running PostgreSQL versions up to 18.4, 17.10, 16.14, 15.18, and 14.23.
What functionality in PostgreSQL is impacted by CVE-2026-6477?
CVE-2026-6477 impacts the PostgreSQL libpq functions, including lo_export(), lo_read(), lo_lseek64(), and lo_tell64().
What could happen if CVE-2026-6477 is exploited?
If exploited, CVE-2026-6477 can allow a superuser to overwrite a client's stack buffer, which may lead to arbitrary code execution.