Description

Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-13T13:17:45.277Z",
  "pubdate": "2026-08-13T13:17:45.277Z",
  "executiveSummary": "A stack buffer overflow vulnerability exists within PostgreSQL argument name matching functionality, enabling a malicious object creator to achieve unknown impacts via manipulated OUT parameter counts.\nThe vulnerability affects PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24.\nDuring exploitation, the attack mechanism is constrained, allowing the writing of only restricted byte values specifically limited to 0x0 and 0x1 bytes.\nSuccessful exploitation requires the ability to create database objects, granting an attacker specific privileges within the database management system.\nThe inherent risk involves potential memory corruption vectors, destabilizing database server processes, or causing unexpected control flow alterations despite the constrained write primitives.\nMitigation requires applying the officially provided vendor updates to remediate the underlying stack-based buffer management flaw.",
  "technicalDetails": "The vulnerability resides in the argument name matching component of PostgreSQL, specifically handling the processing of function or procedure parameters containing OUT parameters.\nThe root cause stems from insufficient bounds checking when parsing or mapping argument names against internal structures, leading to a stack buffer overflow condition.\nThe affected components comprise database routine parsing and parameter resolution mechanisms handling argument definitions during object creation or execution routines.\nAffected software versions include all PostgreSQL installations prior to versions 18.5, 17.11, 16.15, 15.19, and 14.24.\nAn attacker must possess sufficient privileges to create database objects, such as functions or procedures, to supply the malicious input vector.\nThe exploitation flow begins when an attacker crafts a database object definition featuring an manipulated OUT parameter count designed to exceed the allocated stack buffer boundaries during argument name matching.\nUpon processing the malformed parameter configuration, the underlying C-based routine writes data past the intended boundary of the stack-allocated buffer.\nThe payload behavior is strictly constrained due to the primitive limitations, restricting the overwritten memory content exclusively to 0x0 and 0x1 bytes.\nPost-exploitation impact depends on how the stack is corrupted by these constrained writes, potentially leading to denial of service through server crashes or unknown impacts contingent on compiler mitigations and stack layout architectures."
}