CVE-2026-14677 is an integer wraparound vulnerability in PostgreSQL 32-bit builds specifically affecting the pltcl and plperl procedural language handlers. The flaw allows an attacker capable of creating function bodies to trigger undersized memory allocations due to integer wraparound, resulting in out-of-bounds writes. This can enable arbitrary code execution as the OS user running the database server. Similar issues were addressed previously in CVE-2026-6473. Affected versions include PostgreSQL versions before 14.24, 15.19, 16.15, 17.11, and 18.5. A patch is available to remediate this vulnerability.

Successful exploitation allows an attacker with the ability to create function bodies in the vulnerable PostgreSQL 32-bit builds to execute arbitrary code with the privileges of the operating system user running the database. This can lead to full compromise of the database server environment.

A patch is available for this vulnerability. Users should upgrade affected PostgreSQL versions to 14.24 or later, 15.19 or later, 16.15 or later, 17.11 or later, or 18.5 or later to remediate the issue. No additional mitigations are specified beyond applying the official fix.