CVE-2026-6473: PostgreSQL server undersizes allocations, via integer wraparound
Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Other sources
PostgreSQL server undersizes allocations, via integer wraparound
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/postgresql-15to a version that resolves this vulnerability.Fixed in 15.18-0+deb12u1 - Upgrade
Upgrade
debian/postgresql-17to a version that resolves this vulnerability.Fixed in 17.10-0+deb13u1 - Upgrade
Upgrade
debian/postgresql-18to a version that resolves this vulnerability.Fixed in 18.4-1 - Upgrade
Upgrade
PostgreSQL serverto a version that resolves this vulnerability.Fixed in 18.4 - Upgrade
Upgrade
PostgreSQL serverto a version that resolves this vulnerability.Fixed in 17.10 - Upgrade
Upgrade
PostgreSQL serverto a version that resolves this vulnerability.Fixed in 16.14 - Upgrade
Upgrade
PostgreSQL serverto a version that resolves this vulnerability.Fixed in 15.18 - Upgrade
Upgrade
PostgreSQL serverto a version that resolves this vulnerability.Fixed in 14.23
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6473?
CVE-2026-6473 is considered a critical vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2026-6473?
To mitigate CVE-2026-6473, upgrade PostgreSQL to version 14.24 or later, 15.19 or later, 16.15 or later, 17.11 or later, or 18.5 or later.
What systems are affected by CVE-2026-6473?
CVE-2026-6473 affects various versions of PostgreSQL including versions before 14.24, 15.19, 16.15, 17.11, and 18.5.
Who can exploit CVE-2026-6473?
An unprivileged database user can exploit CVE-2026-6473 to cause the PostgreSQL server to undersize allocations.
What are the implications of CVE-2026-6473?
Exploitation of CVE-2026-6473 can lead to out-of-bounds writes and potential execution of arbitrary code by the operating system user running PostgreSQL.