# CVE-2026-6477

## Summary

- **CVE ID:** CVE-2026-6477
- **Severity:** HIGH
- **CVSS Score:** 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- **CWE:** CWE-242
- **Published:** May 14, 2026
- **Last Modified:** Aug 25, 2026

## Description

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response.  Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size.  Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

## Affected Products

- n/a — PostgreSQL (18)
- n/a — PostgreSQL (17)
- n/a — PostgreSQL (16)
- n/a — PostgreSQL (15)
- n/a — PostgreSQL (0)

## References

- [CNA](https://www.postgresql.org/support/security/CVE-2026-6477/)
- [redhat-SADP](https://access.redhat.com/security/cve/CVE-2026-6477)
- [redhat-SADP](https://bugzilla.redhat.com/show_bug.cgi?id=2477442)
- [redhat-SADP](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6477.json)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:27718)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:27743)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:27742)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:27738)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26181)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:29815)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:32994)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26561)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:29953)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26524)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:29904)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:32983)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26525)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:29212)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:28037)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26203)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26204)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:27741)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:21182)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22878)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33441)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34043)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33497)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34362)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34363)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:35880)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:28999)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:28208)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:28143)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42555)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:44308)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:44391)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:44420)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:44481)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:47090)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:49521)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:49908)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:49909)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:50863)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:50779)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54760)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:58981)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.45%
- **EPSS Percentile:** 38.0

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._