CVE-2026-6637

Name	CVE-2026-6637
Description	Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-6269-1, DSA-6270-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
postgresql-13 (PTS)	bullseye	13.16-0+deb11u1	vulnerable
	bullseye (security)	13.23-0+deb11u3	vulnerable
postgresql-15 (PTS)	bookworm	15.17-0+deb12u1	vulnerable
	bookworm (security)	15.18-0+deb12u1	fixed
postgresql-17 (PTS)	trixie	17.9-0+deb13u1	vulnerable
	trixie (security)	17.10-0+deb13u1	fixed
postgresql-18 (PTS)	forky	18.3-1	vulnerable
	sid	18.4-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
postgresql-13	source	(unstable)	(unfixed)
postgresql-15	source	bookworm	15.18-0+deb12u1	DSA-6269-1
postgresql-15	source	(unstable)	(unfixed)
postgresql-17	source	trixie	17.10-0+deb13u1	DSA-6270-1
postgresql-17	source	(unstable)	(unfixed)
postgresql-18	source	(unstable)	18.4-1

https://www.postgresql.org/about/news/postgresql-184-1710-1614-1518-and-1423-released-3297/