CVE-2026-14662: PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound
Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Other sources
PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.15-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.11 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.19 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.24
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14662?
The severity of CVE-2026-14662 is high with a score of 8.8.
How do I fix CVE-2026-14662?
To fix CVE-2026-14662, upgrade PostgreSQL to the latest version that addresses this vulnerability.
What types of systems are affected by CVE-2026-14662?
CVE-2026-14662 affects PostgreSQL installations that use the tsvector and tsquery data types.
What exploits are possible with CVE-2026-14662?
CVE-2026-14662 may allow an unprivileged database user to execute arbitrary code on the server.
When was CVE-2026-14662 published?
CVE-2026-14662 was published on August 13, 2026.