Back Linuxsecurity

SUSE PostgreSQL 15 Key Buffer Overflow and SQL Injection Issues Addressed

Linuxsecurity •LinuxSecurity Advisories • September 3, 2026

Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×

## This update for postgresql15 fixes the following issues: * CVE-2026-6464: `psql` `COPY FROM STDIN` early failure processes data lines as `psql` commands (bsc#1275046). * CVE-2026-6469: `ALTER TABLE ALTER TYPE` resets extended statistics ownership (bsc#1275044). * CVE-2026-6470: failure to check type `USAGE` privilege (bsc#1275043). * CVE-2026-6471: logical decoding can `dlopen` arbitrary file (bsc#1275042). * CVE-2026-14662: `tsvector` and `tsquery` undersize allocations, via integer wraparound (bsc#1275001). * CVE-2026-14663: `pgcrypto`, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002). * CVE-2026-14664: `regexp` heap buffer overflow executes arbitrary code (bsc#1275068).

Announcement ID: SUSE-SU-2026:3940-1 Release Date: 2026-09-03T07:32:49Z Rating: important

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in PostgreSQL Affect Multiple Versions On September 3, 2026, multiple security updates were released for PostgreSQL versions 14, 15, 16, and 18, addressing a total of 24 vulnerabilities. Key vulnerabilities include CVE-2026-6464, which allows early failure processing of data lines as commands, and CVE-2026-14664, which involves a heap buffer overflow that can execute arbitrary code. Other notable vulnerabilities include issues with privilege checks and potential arbitrary file access. These vulnerabilities affect various SUSE Linux distributions, including openSUSE and SUSE Linux Enterprise Server. The updates are crucial for maintaining system security and preventing potential exploitation. Administrators are urged to apply the patches immediately to mitigate risks. The vulnerabilities were published on August 13, 2026, with proof-of-concept code for CVE-2026-14662 released on September 1, 2026. 7 sources 72

Extracted Entities

SUSE PostgreSQL 15 Key Buffer Overflow and SQL Injection Issues Addressed

The full story

Extracted Entities

Attack Types (1)

CVEs (7)

CWE Weaknesses (2)

Platforms (2)