CVE-2026-14680

PostgreSQL type confusion via "internal" arguments

HIGH 8.8

En bref

Source: NVD
EPSS: EPSS 0.42 % · centile 36 (2026-10-28)
État: PUBLISHED
Publiée: 2026-08-13 13:00 UTC
Mise à jour: 2026-08-29 23:07 UTC
Attribuée par: PostgreSQL
Statut NVD: Modified

Description

Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Faiblesses (CWE)

CWE-843 — Confusion de type (accès à une ressource via un type incompatible)

Références

https://www.postgresql.org/support/security/CVE-2026-14680/

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	PostgreSQL
CVSS 3.1	HIGH 8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	NVD · f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 (Secondary)

Références européennes

ENISA EUVD · EUVD-2026-57844
GCVE · GCVE-0-2026-14680

Avis du CERT-FR

CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2026-AVI-1336 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1024 — Multiples vulnérabilités dans PostgreSQL · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 14.0 < 14.24
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 15.0 < 15.19
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 16.0 < 16.15
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 17.0 < 17.11
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 18.0 < 18.5

Produits affectés

Produit	Versions
PostgreSQL	affected 18 < 18.6 ; affected 17 < 17.11 ; affected 16 < 16.15 ; affected 15 < 15.19 ; affected 0 < 14.24

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD