CVE-2026-14664
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. Versions before 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Risk Assessment
A user with query creation privileges could take over the database server, potentially leading to full system and data compromise.
Recommendation
Immediately upgrade PostgreSQL to the latest patched version.
Original NVD description (English source)
Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.