CVE-2026-14677

Modified Modified - Updated After Analysis

Integer Wraparound in PostgreSQL plperl and pltcl

Publication date: 2026-08-13

Last updated on: 2026-08-29

Assigner: PostgreSQL

Description

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-29

Generated

2026-09-03

AI Q&A

2026-08-13

EPSS Evaluated

2026-09-01

NVD

CVE-2026-14677

EUVD

EUVD-2026-57841

Affected Vendors & Products

Vendor	Product	Version / Range
postgresql	postgresql	From 14.0 (inc) to 14.24 (exc)
postgresql	postgresql	From 15.0 (inc) to 15.19 (exc)
postgresql	postgresql	From 16.0 (inc) to 16.15 (exc)
postgresql	postgresql	From 17.0 (inc) to 17.11 (exc)
postgresql	postgresql	From 18.0 (inc) to 18.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer wraparound issue in PostgreSQL's 32-bit builds of pltcl and plperl extensions. It allows an attacker who can create database objects to force the server to allocate too little memory for function bodies, leading to out-of-bounds memory writes that may execute arbitrary code with the privileges of the database operating system user.

Detection Guidance

To detect this vulnerability, check your PostgreSQL version using 'psql --version' or 'SELECT version();'. If you are running a 32-bit build of PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, or 14.24, your system is affected.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code on the system running the PostgreSQL database. This could lead to unauthorized access, data theft, or system compromise, depending on the attacker's goals and the database's role in the environment.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected PostgreSQL versions must address this to maintain data protection and regulatory compliance.

Mitigation Strategies

Upgrade PostgreSQL to a patched version (18.5, 17.11, 16.15, 15.19, or 14.24 or later). Disable pltcl and plperl extensions if not required. Apply the latest security patches from PostgreSQL immediately.

Hi! I’m here to help you understand CVE-2026-14677. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70