AZL-95720

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-95720.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-95720

Upstream

CVE-2026-14680

Published

2026-08-13T13:17:45Z

Modified

2026-09-07T05:28:29Z

Summary

CVE-2026-14680 affecting package postgresql 16.14-1

Details

Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-14680

Affected packages

Azure Linux:3 / postgresql

Package

Name: postgresql
Purl: pkg:rpm/azure-linux/postgresql

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

16.14-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-95720.json"