CVE-2026-14677 HIGH

CVE-2026-14677: PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound

Vendor N/A

Product PostgreSQL

Weakness CWE-190

Published August 13, 2026

Last update August 13, 2026

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Key dates

02Disclosure timeline

August 13, 2026 CVE published

August 13, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-14677 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/190.html AskarLabs — CWE-190 write-up Integer Overflow or Wraparound

Identifiers

CVE CVE-2026-14677

CWE CWE-190

CVSS 8.8 / HIGH

Affected versions

Vendor N/A

Product PostgreSQL

Affected ≥ 18 and < 18.5

Vendor N/A

Product PostgreSQL

Affected ≥ 17 and < 17.11

Vendor N/A

Product PostgreSQL

Affected ≥ 16 and < 16.15

Vendor N/A

Product PostgreSQL

Affected ≥ 15 and < 15.19

Vendor N/A

Product PostgreSQL

Affected < 14.24