CVE-2026-6473 PUBLISHED

PostgreSQL server undersizes allocations, via integer wraparound

Assigner: PostgreSQL
Reserved: 17.04.2026 Published: 14.05.2026 Updated: 15.05.2026

Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor n/a
Product PostgreSQL
Versions Default: unaffected
  • affected from 18 to 18.4 (excl.)
  • affected from 17 to 17.10 (excl.)
  • affected from 16 to 16.14 (excl.)
  • affected from 15 to 15.18 (excl.)
  • affected from 0 to 14.23 (excl.)

Credits

  • The PostgreSQL project thanks Anemone, A1ex, Xint Code, Jihe Wang, Jingzhou Fu, Pavel Kohout, Petr Simecek, www.aisle.com, Bruce Dang of Calif.io, and Sven Klemm for reporting this problem.

References

Problem Types

  • Integer Overflow or Wraparound CWE