CVE-2026-6473
Discovered by AISLEPUBLISHEDCWE-190
Description
Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
CVSS Base Scores
CVSS v3.1(Primary)
8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Version | Status |
|---|---|---|---|
| n/a | PostgreSQL | 18 | affected |
| n/a | PostgreSQL | 17 | — |
| n/a | PostgreSQL | 16 | — |
| n/a | PostgreSQL | 15 | — |
| n/a | PostgreSQL | 0 | — |
Credits
- The PostgreSQL project thanks Anemone, A1ex, Xint Code, Jihe Wang, Jingzhou Fu, Pavel Kohout, Petr Simecek, www.aisle.com, Bruce Dang of Calif.io, and Sven Klemm for reporting this problem.