CVE-2026-14677
Received Received - Intake

Integer Wraparound in PostgreSQL plperl and pltcl

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: PostgreSQL

Description
Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-14677
EUVD
EUVD-2026-57841

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
postgresql postgresql to 18.5 (exc)
postgresql postgresql to 17.11 (exc)
postgresql postgresql to 16.15 (exc)
postgresql postgresql to 15.19 (exc)
postgresql postgresql to 14.24 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an integer wraparound issue in PostgreSQL's 32-bit builds of pltcl and plperl extensions. It allows an attacker who can create database objects to force the server to allocate too little memory for function bodies, leading to out-of-bounds memory writes that may execute arbitrary code with the privileges of the database operating system user.

Detection Guidance

To detect this vulnerability, check your PostgreSQL version using 'psql --version' or 'SELECT version();'. If you are running a 32-bit build of PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, or 14.24, your system is affected.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code on the system running the PostgreSQL database. This could lead to unauthorized access, data theft, or system compromise, depending on the attacker's goals and the database's role in the environment.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected PostgreSQL versions must address this to maintain data protection and regulatory compliance.

Mitigation Strategies

Upgrade PostgreSQL to a patched version (18.5, 17.11, 16.15, 15.19, or 14.24 or later). Disable pltcl and plperl extensions if not required. Apply the latest security patches from PostgreSQL immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14677. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart