CVE-2026-6575: 
PostgreSQL 脆弱性の分析と軽減

CVE-2026-6575 is a buffer over-read vulnerability in the PostgreSQL function pg_restore_attribute_stats(), which accepts array values of unmatched length, causing query planning to read past the end of one array. This allows an authenticated table maintainer to infer memory values beyond the intended array boundaries. Only PostgreSQL major version 18 is affected; specifically, minor versions before 18.4. Versions prior to PostgreSQL 18 are unaffected. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, PostgreSQL Advisory).

The root cause is classified as CWE-126 (Buffer Over-read): the pg_restore_attribute_stats() function fails to validate that input arrays are of matching length before passing them to the query planner, which then reads past the end of one of the arrays (GitHub Advisory). The attack vector is network-based and requires low privileges — specifically, the attacker must hold table maintainer privileges on the target database. No user interaction is required. The fix is available in the PostgreSQL git repository as commit 6d6348f0329dd50ba9f954df28c2ffa88a15df07 (PostgreSQL Git).

Successful exploitation results in a limited memory disclosure: an authenticated table maintainer can infer the contents of memory locations beyond the intended array boundary during query planning. The impact is confined to confidentiality (low), with no integrity or availability consequences. There is no evidence that this vulnerability enables privilege escalation, lateral movement, or arbitrary code execution (GitHub Advisory, PostgreSQL Advisory).

1. Identify target: Confirm the target PostgreSQL instance is running major version 18 with a minor version before 18.4.
2. Obtain table maintainer privileges: The attacker must already hold or acquire table maintainer (e.g., table owner) privileges on a target database, either through legitimate access or credential compromise.
3. Craft malicious call: Invoke pg_restore_attribute_stats() with array arguments of deliberately mismatched lengths to trigger the buffer over-read during query planning.
4. Infer memory contents: Observe query planner behavior or error output to infer values from memory locations beyond the intended array boundary, potentially exposing sensitive in-memory data.

Note: No public PoC or detailed exploitation technique has been published; these steps are based on the vulnerability description (GitHub Advisory, PostgreSQL Advisory).

• Logs: PostgreSQL server logs showing repeated or unusual calls to pg_restore_attribute_stats() with mismatched array parameters, potentially accompanied by query planner warnings or errors.
• Database Activity: Queries from table maintainer accounts invoking pg_restore_attribute_stats() with atypical argument patterns outside of normal maintenance windows.
• Network: Unexpected or high-frequency connections from low-privileged database users performing attribute statistics restoration operations.

The primary remediation is to upgrade PostgreSQL 18 to version 18.4 or later, which contains the fix (PostgreSQL Release News, PostgreSQL Release Notes). As a workaround, restrict the pg_restore_attribute_stats() function and table maintenance privileges to only fully trusted users. Monitor for unusual invocations of this function as a detection measure. PostgreSQL versions prior to 18 are not affected and require no action.

The vulnerability was disclosed as part of the PostgreSQL May 2026 security release, which addressed 11 CVEs simultaneously, drawing coverage from security news outlets including SecurityOnline, CyberPress, GBHackers, and CybersecurityNews (SecurityOnline, GBHackers). Community blog posts such as "Eleven CVEs Walk Into a Release" on thebuild.com provided analysis of the full release (TheBuild Blog). Downstream distributions including openSUSE, Ubuntu, and Amazon Linux 2023 issued their own security advisories incorporating the PostgreSQL 18.4 update. Overall community sentiment treated this specific CVE as low-severity given its limited scope and the requirement for existing privileges.