Linux · SUSE Linux Enterprise · Security advisory · August 30, 2026
SUSE-SU-2026:23577-1: postgresql18 security update
SUSE-SU-2026:23577-1, released August 30, 2026, fixes 28 CVEs in postgresql18 (version 18.6-160000.1.1). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
28
None rated Critical
Exploited
0
None reported
Highest CVSS
8.8
Base score, 0 to 10
Highest EPSS
0.0068
52nd percentile
Priority of the 28 CVEs
Patch now 0
Urgent 0
High 18
Routine 10
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| postgresql18 | sles 16.0 | 18.6-160000.1.1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| High | CVE-2026-16239 | PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code | 8.8 | 0.0068 | None reported |
| High | CVE-2026-14669 | postgresql14: `to_char` heap buffer overflow executes arbitrary code (bsc#1275065). | 8.8 | 0.0066 | None reported |
| High | CVE-2026-15742 | PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound | 8.8 | 0.0060 | None reported |
| High | CVE-2026-6471 | PostgreSQL logical decoding can dlopen arbitrary file | 8.8 | 0.0053 | None reported |
| High | CVE-2026-14662 | PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound | 8.8 | 0.0046 | None reported |
| High | CVE-2026-14664 | PostgreSQL regexp heap buffer overflow executes arbitrary code | 8.8 | 0.0044 | None reported |
| High | CVE-2026-14670 | PostgreSQL plperl tied object heap buffer overflow executes arbitrary code | 8.8 | 0.0044 | None reported |
| High | CVE-2026-14676 | postgresql18: `pg_stat_statements` heap buffer overflow executes arbitrary code (bsc#1275060). | 8.8 | 0.0044 | None reported |
| High | CVE-2026-15741 | PostgreSQL expression deparse allows SQL injection via EXTRACT argument | 8.8 | 0.0044 | None reported |
| High | CVE-2026-19385 | PostgreSQL pg_dump heap buffer overflow executes arbitrary code | 8.8 | 0.0043 | None reported |
| High | CVE-2026-14671 | PostgreSQL refint plan cache type confusion executes arbitrary code | 8.8 | 0.0042 | None reported |
| High | CVE-2026-14680 | PostgreSQL type confusion via "internal" arguments | 8.8 | 0.0042 | None reported |
| High | CVE-2026-14677 | PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound | 8.8 | 0.0041 | None reported |
| High | CVE-2026-16238 | PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code | 8.8 | 0.0041 | None reported |
| High | CVE-2026-6464 | PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands | 8.8 | 0.0036 | None reported |
| High | CVE-2026-18408 | PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client | 8.8 | 0.0036 | None reported |
| High | CVE-2026-14668 | PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read | 8.8 | 0.0033 | None reported |
| High | CVE-2026-14679 | postgresql14: stack buffer overflow in argument match writes `0x0` and `0x1` to server memory (bsc#1275057). | 8.8 | 0.0029 | None reported |
| Routine | CVE-2026-14672 | PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle | 5.3 | 0.0039 | None reported |
| Routine | CVE-2026-16241 | postgresql14: ECPG integer underflow can crash the client (bsc#1275050). | 3.8 | 0.0034 | None reported |
| Routine | CVE-2026-6470 | PostgreSQL fails to check type USAGE privilege | 4.3 | 0.0033 | None reported |
| Routine | CVE-2026-6469 | PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership | 3.8 | 0.0032 | None reported |
| Routine | CVE-2026-14678 | PostgreSQL pg_trgm picksplit reads past end of buffer | 4.3 | 0.0030 | None reported |
| Routine | CVE-2026-18024 | PostgreSQL ascii() function reads past end of buffer | 4.3 | 0.0030 | None reported |
| Routine | CVE-2026-14673 | PostgreSQL amcheck does not clear untrusted search path | 3.8 | 0.0027 | None reported |
Showing 1 to 25 of 28
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.