CVE-2026-6637: PostgreSQL refint allows stack buffer overflow and SQL injection
Last updated 22 May 2026
Other sources
PostgreSQL refint allows stack buffer overflow and SQL injection
— Microsoft
Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/postgresql-15to a version that resolves this vulnerability.Fixed in 15.18-0+deb12u1 - Upgrade
Upgrade
debian/postgresql-17to a version that resolves this vulnerability.Fixed in 17.10-0+deb13u1 - Upgrade
Upgrade
debian/postgresql-18to a version that resolves this vulnerability.Fixed in 18.4-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.10 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.18 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.23
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6637?
CVE-2026-6637 is considered a critical severity vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2026-6637?
To fix CVE-2026-6637, upgrade PostgreSQL to version 19.0 or later, which resolves the vulnerability.
Who is affected by CVE-2026-6637?
CVE-2026-6637 affects PostgreSQL versions up to 18.4, 17.10, 16.14, 15.18, and 14.23.
What types of attacks can CVE-2026-6637 enable?
CVE-2026-6637 can allow stack buffer overflow and SQL injection attacks, enabling unprivileged users to execute arbitrary code.
Is there any workaround for CVE-2026-6637?
Currently, the recommended solution for CVE-2026-6637 is to upgrade rather than implement a workaround.