CVE-2026-15742
Received Received - Intake

Integer Wraparound in PostgreSQL fuzzystrmatch

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: PostgreSQL

Description
Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-15742
EUVD
EUVD-2026-57847

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
postgresql postgresql to 18.5|end_excluding=17.11|end_excluding=16.15|end_excluding=15.19|end_excluding=14.24 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an integer wraparound flaw in PostgreSQL's fuzzystrmatch module. It allows an attacker to write to arbitrary memory addresses by providing extreme inputs to the SQL functions levenshtein() or levenshtein_less_equal(). This can lead to arbitrary code execution with the privileges of the database's operating system user.

Detection Guidance

To detect this vulnerability, check the PostgreSQL version running on your system. Affected versions are those prior to 18.5, 17.11, 16.15, 15.19, and 14.24. Use the command: psql --version. If the version is below the specified thresholds, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code on the system running the PostgreSQL database. This could lead to unauthorized data access, modification, or deletion, system compromise, or further network infiltration depending on the database's privileges.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating compliance requirements under GDPR, HIPAA, and other regulations. Organizations using affected PostgreSQL versions may face legal penalties, reputational damage, and loss of trust due to potential data breaches.

Mitigation Strategies

Immediately upgrade PostgreSQL to a patched version: 18.5, 17.11, 16.15, 15.19, or 14.24 or later. Disable the fuzzystrmatch module if not required. Restrict database user privileges to limit potential damage from exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15742. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart