CVE-2026-6477: PostgreSQL libpq Vulnerability Allows Superuser Client Stack Overwrite

The National Vulnerability Database has detailed CVE-2026-6477, a high-severity vulnerability (CVSS 8.8) affecting PostgreSQL’s libpq library. The issue stems from the PQfn(..., result_is_int=0, ...) function within lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions. This function, similar to gets(), stores server-determined data of arbitrary length into a client-side buffer of unspecified size.

This flaw allows a PostgreSQL server superuser to overwrite a client’s stack buffer with an arbitrarily large response. Critically, both the \lo_export command in psql and the pg_dump utility call lo_read(). This means a malicious superuser can exploit this to overwrite memory in pg_dump or psql clients. Defenders need to understand that this isn’t a remote code execution against the server, but rather a powerful client-side attack if a superuser account is compromised or malicious.

Versions prior to PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are impacted. This is a classic buffer overflow scenario (CWE-242) that, while requiring superuser privileges on the server, can lead to significant client-side compromise or denial of service for administrative tools. The attacker’s calculus here is to leverage a compromised database superuser account to further compromise administrative workstations or backup systems.