PostgreSQL ECPG integer underflow can crash the client (CVE-2026-16241)
An integer underflow vulnerability exists in PostgreSQL ECPG client that can cause the client to crash when processing a bytea value missing its mandatory prefix. This flaw allows a database server administrator to trigger a temporary denial of service against the ECPG client. The client may overwrite a large memory region with uncontrolled bytes, typically resulting in a segmentation fault (SIGSEGV). In rare cases, this could lead to client-specific integrity impacts. Versions before PostgreSQL 14.24, 15.19, 16.15, 17.11, and 18.6 are affected.
AI Analysis
Technical Summary
CVE-2026-16241 describes an integer underflow in the PostgreSQL Embedded C Preprocessor (ECPG) client. When the client receives a bytea value lacking the required prefix, it performs an underflow that causes it to overwrite a large memory region with attacker-controlled data. This typically results in a crash (SIGSEGV), causing a temporary denial of service. Rarely, the memory corruption could impact client integrity. The vulnerability affects PostgreSQL versions prior to 14.24, 15.19, 16.15, 17.11, and 18.6. A patch is available to address this issue.
Potential Impact
The primary impact is a temporary denial of service against the ECPG client due to client crashes triggered by malformed bytea values. There is a low severity risk of client-specific integrity compromise in rare cases due to memory corruption. No known exploits are reported in the wild at this time.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade PostgreSQL to versions 14.24, 15.19, 16.15, 17.11, 18.6 or later to remediate the issue. No additional mitigations are specified by the vendor advisory.
PostgreSQL ECPG integer underflow can crash the client (CVE-2026-16241)
Description
An integer underflow vulnerability exists in PostgreSQL ECPG client that can cause the client to crash when processing a bytea value missing its mandatory prefix. This flaw allows a database server administrator to trigger a temporary denial of service against the ECPG client. The client may overwrite a large memory region with uncontrolled bytes, typically resulting in a segmentation fault (SIGSEGV). In rare cases, this could lead to client-specific integrity impacts. Versions before PostgreSQL 14.24, 15.19, 16.15, 17.11, and 18.6 are affected.
Affected software
pkg:deb/postgresql/postgresqlpkg:github/postgresql/postgresqlRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-16241 describes an integer underflow in the PostgreSQL Embedded C Preprocessor (ECPG) client. When the client receives a bytea value lacking the required prefix, it performs an underflow that causes it to overwrite a large memory region with attacker-controlled data. This typically results in a crash (SIGSEGV), causing a temporary denial of service. Rarely, the memory corruption could impact client integrity. The vulnerability affects PostgreSQL versions prior to 14.24, 15.19, 16.15, 17.11, and 18.6. A patch is available to address this issue.
Potential Impact
The primary impact is a temporary denial of service against the ECPG client due to client crashes triggered by malformed bytea values. There is a low severity risk of client-specific integrity compromise in rare cases due to memory corruption. No known exploits are reported in the wild at this time.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade PostgreSQL to versions 14.24, 15.19, 16.15, 17.11, 18.6 or later to remediate the issue. No additional mitigations are specified by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-v76f-gmv6-95jw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-16241"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a7e0366bf8831d5398f854f
Added to database: 08/13/2026, 17:48:22 UTC
Last enriched: 09/08/2026, 15:14:18 UTC
Last updated: 09/27/2026, 13:47:42 UTC
Views: 48
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.