Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major version 18, minor versions before PostgreSQL 18.4 are affected. Versions before PostgreSQL 18 are unaffected.
References
| Link | Resource |
|---|---|
| https://www.postgresql.org/support/security/CVE-2026-6575/ | Patch Vendor Advisory |
Configurations
History
18 May 2026, 15:04
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* | |
| References | () https://www.postgresql.org/support/security/CVE-2026-6575/ - Patch, Vendor Advisory | |
| First Time |
Postgresql
Postgresql postgresql |
14 May 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-14 14:16
Updated : 2026-05-18 15:04
NVD link : CVE-2026-6575
Mitre link : CVE-2026-6575
CVE.ORG link : CVE-2026-6575
JSON object : View
Products Affected
postgresql
- postgresql
CWE
CWE-126
Buffer Over-read