Executive brief
PostgreSQL is a widely used database system for storing and managing organizational data. A vulnerability in several server features allows a user with basic database access to trigger a memory error by providing specially crafted, large inputs. This could allow an attacker to crash the database service or potentially execute unauthorized commands on the underlying server, leading to data theft or full system compromise.
Technical details
An integer wraparound vulnerability (CWE-190) exists within multiple core server features of PostgreSQL. By providing gigabyte-scale inputs to specific database functions, an authenticated but unprivileged user can trigger an integer overflow that results in an undersized memory allocation. This leads to an out-of-bounds write, which can cause a segmentation fault (DoS) or potentially allow arbitrary code execution with the privileges of the operating system user running the PostgreSQL service. The vulnerability is reachable over the network but requires valid database credentials. Patches are available in versions 18.4, 17.10, 16.14, 15.18, and 14.23.
Affected products
- PostgreSQL Global Development Group PostgreSQL < 18.4, < 17.10, < 16.14, < 15.18, < 14.23
Timeline
- 2026-05-12: patched: Fixes released in multiple branches.
- 2026-05-14: disclosed: Public advisory published.