CVE-2026-14677: Integer Overflow or Wraparound in PostgreSQL
An integer wraparound vulnerability exists in 32-bit builds of PostgreSQL's pltcl and plperl procedural languages. This flaw allows an attacker with function creation privileges to cause undersized memory allocation and out-of-bounds writes via crafted function bodies, potentially leading to arbitrary code execution with the database server's operating system user privileges. Versions before PostgreSQL 14.24, 15.19, 16.15, 17.11, and 18.5 are affected.
AI Analysis
Technical Summary
CVE-2026-14677 is an integer overflow or wraparound vulnerability in PostgreSQL 32-bit builds specifically affecting the pltcl and plperl procedural languages. The vulnerability allows an attacker who can create functions to trigger undersized memory allocations and write out-of-bounds, which may lead to arbitrary code execution as the OS user running the database. This issue is similar to CVE-2026-6473, which addressed related problems. The affected versions are all PostgreSQL releases prior to 14.24, 15.19, 16.15, 17.11, and 18.5.
Potential Impact
Successful exploitation can result in arbitrary code execution with the privileges of the operating system user running the PostgreSQL server. This can lead to full compromise of the database server environment. The vulnerability requires the ability to create functions in pltcl or plperl languages and affects only 32-bit builds.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict function creation privileges in pltcl and plperl procedural languages on 32-bit PostgreSQL builds to trusted users only. Monitor vendor channels for updates and apply patches once released.
CVE-2026-14677: Integer Overflow or Wraparound in PostgreSQL
Description
An integer wraparound vulnerability exists in 32-bit builds of PostgreSQL's pltcl and plperl procedural languages. This flaw allows an attacker with function creation privileges to cause undersized memory allocation and out-of-bounds writes via crafted function bodies, potentially leading to arbitrary code execution with the database server's operating system user privileges. Versions before PostgreSQL 14.24, 15.19, 16.15, 17.11, and 18.5 are affected.
CVSS v3.1
Score 8.8high
Affected software
pkg:deb/postgresql/postgresqlRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-14677 is an integer overflow or wraparound vulnerability in PostgreSQL 32-bit builds specifically affecting the pltcl and plperl procedural languages. The vulnerability allows an attacker who can create functions to trigger undersized memory allocations and write out-of-bounds, which may lead to arbitrary code execution as the OS user running the database. This issue is similar to CVE-2026-6473, which addressed related problems. The affected versions are all PostgreSQL releases prior to 14.24, 15.19, 16.15, 17.11, and 18.5.
Potential Impact
Successful exploitation can result in arbitrary code execution with the privileges of the operating system user running the PostgreSQL server. This can lead to full compromise of the database server environment. The vulnerability requires the ability to create functions in pltcl or plperl languages and affects only 32-bit builds.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict function creation privileges in pltcl and plperl procedural languages on 32-bit PostgreSQL builds to trusted users only. Monitor vendor channels for updates and apply patches once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- PostgreSQL
- Date Reserved
- 2026-07-03T20:28:16.721Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7dc617bf8831d5393e53a4
Added to database: 08/13/2026, 13:26:47 UTC
Last enriched: 08/13/2026, 18:13:42 UTC
Last updated: 08/13/2026, 23:40:59 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.