CVE-2026-15742: PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound
Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshteinlessequal(). Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQL fuzzystrmatchto a version that resolves this vulnerability.Fixed in 18.5 - Upgrade
Upgrade
PostgreSQL fuzzystrmatchto a version that resolves this vulnerability.Fixed in 17.11 - Upgrade
Upgrade
PostgreSQL fuzzystrmatchto a version that resolves this vulnerability.Fixed in 16.15 - Upgrade
Upgrade
PostgreSQL fuzzystrmatchto a version that resolves this vulnerability.Fixed in 15.19 - Upgrade
Upgrade
PostgreSQL fuzzystrmatchto a version that resolves this vulnerability.Fixed in 14.24
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15742?
CVE-2026-15742 has a severity rating of high with a score of 8.8.
How do I fix CVE-2026-15742?
To mitigate CVE-2026-15742, upgrade to PostgreSQL version 18.5, 17.11, or later.
What software is affected by CVE-2026-15742?
CVE-2026-15742 affects the PostgreSQL fuzzystrmatch extension.
What kind of impact does CVE-2026-15742 have?
CVE-2026-15742 allows arbitrary code execution due to integer wraparound in vulnerable SQL functions.
Which specific functions are involved in CVE-2026-15742?
The functions involved in CVE-2026-15742 are levenshtein() and levenshtein_less_equal().