Description

Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before PostgreSQL 18 are unaffected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T13:17:44.907Z",
  "pubdate": "2026-08-13T13:17:44.907Z",
  "executiveSummary": "A heap buffer overflow vulnerability exists within the PostgreSQL extension pg_stat_statements, allowing a malicious query author to achieve arbitrary code execution under the security context of the operating system user running the database instance. The flaw stems from improper memory handling when processing crafted queries containing specialized array constants.\nThis vulnerability specifically impacts PostgreSQL major version 18, affecting all minor versions prior to PostgreSQL 18.5, while versions prior to PostgreSQL 18 remain unaffected.\nExploitation requires the ability to submit crafted database queries, typically mapping to authenticated database user privileges depending on local database access controls. Successful exploitation presents severe risk implications, including complete system compromise, unauthorized data access, privilege escalation, and lateral movement within the underlying operating system environment due to execution under the database system user privileges.",
  "technicalDetails": "The vulnerability resides in the heap memory allocation and management logic of the pg_stat_statements extension, specifically within the subsystem responsible for normalizing and tracking SQL query statements and their parameter structures.\nThe root cause is a heap buffer overflow triggered during the parsing and processing of crafted queries containing specifically constructed array constants. When the extension attempts to calculate buffer sizes or copy array constant data into allocated heap memory buffers, inadequate bounds checking or integer arithmetic calculation flaws result in writing past the allocated boundaries of the heap buffer.\nThe attack vector involves a malicious database user supplying a specially crafted SQL query containing malicious array constants to the PostgreSQL server. Upon execution, the database engine passes the query structure to pg_stat_statements for normalization and statistics tracking.\nDuring the internal handling of the array constants within the vulnerable component, the heap buffer overflow occurs, corrupting adjacent heap memory structures. By carefully crafting the size and content of the array constants, an attacker can manipulate heap metadata or function pointers.\nThis memory corruption enables the attacker to hijack control flow and execute arbitrary shell code or system commands with the privileges of the operating system user executing the PostgreSQL server process.\nThe affected component is the pg_stat_statements extension within PostgreSQL major version 18, specifically minor versions before PostgreSQL 18.5. Authentication and authorization requirements depend on the database access permissions needed to execute queries against the database engine, though standard database users capable of executing SQL statements can potentially trigger the flaw. Network exposure is tied to the database service listener port (typically TCP port 5432)."
}