CVE-2026-14677: PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound
Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Other sources
PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.15-1 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.6 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.11 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.15 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.19 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.24
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14677?
CVE-2026-14677 has a high severity score of 8.8.
How do I fix CVE-2026-14677?
To mitigate CVE-2026-14677, update PostgreSQL to the latest version where the vulnerability is addressed.
What type of vulnerability is CVE-2026-14677?
CVE-2026-14677 is classified as an integer overflow vulnerability.
Who is affected by CVE-2026-14677?
CVE-2026-14677 affects users of PostgreSQL 32-bit builds specifically using pltcl and plperl.
What can an attacker do by exploiting CVE-2026-14677?
An attacker can exploit CVE-2026-14677 to execute arbitrary code under the operating system user running the PostgreSQL database.