Description
Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Published: 2026-08-13
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A type confusion bug in PostgreSQL’s refint module allows an object creator to execute arbitrary code as the operating system user running the database service. This flaw maps to CWE‑843, a type mismatch that can lead to the compromise of system integrity and confidentiality by allowing the attacker to run code with the database server’s privileges.

Affected Systems

The vulnerability affects PostgreSQL releases prior to 18.5, 17.11, 16.15, 15.19, and 14.24. Users running any of these versions on a PostgreSQL server are at risk.

Risk and Exploitability

The CVSS score is 8.8, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a user with object‑creation privileges within the database; once such a user introduces a malicious refint object, the code runs with the database process’s OS privileges.

Generated by OpenCVE AI on August 13, 2026 at 14:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade PostgreSQL to any supported version that includes the fix: 18.5 or later, 17.11 or later, 16.15 or later, 15.19 or later, or 14.24 or later.
  • If an upgrade cannot be performed immediately, disable or remove the refint extension from the database to prevent the bug from being triggered.
  • Limit CREATE privileges for refint objects to trusted roles only, reducing the attack surface for malicious object creation.

Generated by OpenCVE AI on August 13, 2026 at 14:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Postgresql
Postgresql postgresql
Vendors & Products Postgresql
Postgresql postgresql

Thu, 13 Aug 2026 13:15:00 +0000

Type Values Removed Values Added
Description Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Title PostgreSQL refint plan cache type confusion executes arbitrary code
Weaknesses CWE-843
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Postgresql Postgresql
cve-icon MITRE

Status: PUBLISHED

Assigner: PostgreSQL

Published:

Updated: 2026-08-13T15:39:58.479Z

Reserved: 2026-07-03T20:28:13.192Z

Link: CVE-2026-14671

cve-icon Vulnrichment

Updated: 2026-08-13T15:39:54.423Z

cve-icon NVD

Status : Received

Published: 2026-08-13T13:17:44.530

Modified: 2026-08-13T16:17:56.320

Link: CVE-2026-14671

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T14:45:03Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')