CVE-2026-14677

Details

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Affected Packages

PostgreSQL

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1703)Windows 10 (1709)Windows 10 (1803)

Fixed in:

14.2415.1916.1517.1118.6

postgresql@14

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@15

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@16

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@17

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@18

brew

Fixed in:

14.2415.1916.1517.1118.6

References

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-14677

WEB

https://www.postgresql.org/support/security/CVE-2026-14677/