Executive brief
A vulnerability in the PostgreSQL client library (libpq) allows a malicious or compromised database server to take control of a client application, such as psql or pg_dump. By sending a specially crafted response, the server can overwrite the client's memory, potentially leading to unauthorized data access or the execution of malicious code on the client machine. This risk is particularly high for administrators performing backups or using command-line tools against untrusted database instances.
Technical details
The vulnerability exists in the libpq functions lo_export(), lo_read(), lo_lseek64(), and lo_tell64() due to the use of the inherently dangerous PQfn() function with result_is_int=0. This configuration causes the library to store arbitrary-length data from the server into a fixed-size client stack buffer without proper bounds checking, similar to the classic 'gets()' vulnerability. An attacker with server superuser privileges can exploit this by sending an oversized response to a client using tools like psql or pg_dump. Successful exploitation can lead to arbitrary code execution on the client system. The issue is resolved in PostgreSQL versions 18.4, 17.10, 16.14, 15.18, and 14.23.
Affected products
- PostgreSQL PostgreSQL libpq < 18.4, < 17.10, < 16.14, < 15.18, < 14.23
Timeline
- 2026-05-12: patched: Fixes released for supported versions.
- 2026-05-14: disclosed: Public advisory published.