CVE-2026-6637: PostgreSQL refint allows stack buffer overflow and SQL injection
Last updated 22 May 2026
Other sources
PostgreSQL refint allows stack buffer overflow and SQL injection
— Microsoft
Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6637?
CVE-2026-6637 is considered a critical severity vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2026-6637?
To fix CVE-2026-6637, upgrade PostgreSQL to version 19.0 or later, which resolves the vulnerability.
Who is affected by CVE-2026-6637?
CVE-2026-6637 affects PostgreSQL versions up to 18.4, 17.10, 16.14, 15.18, and 14.23.
What types of attacks can CVE-2026-6637 enable?
CVE-2026-6637 can allow stack buffer overflow and SQL injection attacks, enabling unprivileged users to execute arbitrary code.
Is there any workaround for CVE-2026-6637?
Currently, the recommended solution for CVE-2026-6637 is to upgrade rather than implement a workaround.