CVE-2026-14671
Received Received - Intake

Type Confusion in PostgreSQL refint Module

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: PostgreSQL

Description
Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-14671
EUVD
EUVD-2026-57858

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
postgresql postgresql to 18.5|end_excluding=17.11|end_excluding=16.15|end_excluding=15.19|end_excluding=14.24 (exc)
postgresql postgresql to 14.24 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-843 The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a type confusion issue in PostgreSQL's 'refint' module that allows an object creator to execute arbitrary code as the operating system user running the database. The flaw was fixed as a non-security bug with the title 'refint: Remove plan cache.' in the PostgreSQL git repository.

Detection Guidance

To detect this vulnerability, check your PostgreSQL version using 'psql --version' or 'SELECT version();'. If your version is below 18.5, 17.11, 16.15, 15.19, or 14.24, your system is affected. Additionally, review PostgreSQL logs for unusual activity or errors related to the 'refint' module.

Impact Analysis

An attacker who can create objects in the database could exploit this to run arbitrary code with the privileges of the database user, potentially leading to data breaches, system compromise, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations that mandate strict data protection and integrity controls.

Mitigation Strategies

Immediately upgrade PostgreSQL to a patched version (18.5 or later, 17.11 or later, 16.15 or later, 15.19 or later, or 14.24 or later). If upgrading is not possible, disable the 'refint' module in your PostgreSQL configuration to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14671. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart