Threats Tagged 'cve-2026-16241'

This security update for PostgreSQL 18 addresses multiple vulnerabilities affecting various components such as psql, logical decoding, pgcrypto, regexp, and others. The issues include heap buffer overflows that can lead to arbitrary code execution, type confusion, integer wraparound causing undersize allocations, privilege enforcement failures, and SQL injection risks. The update fixes these vulnerabilities to improve the security and stability of PostgreSQL 18 and related versions.

An integer underflow vulnerability exists in PostgreSQL ECPG client that can cause the client to crash when processing a bytea value missing its mandatory prefix. This flaw allows a database server administrator to trigger a temporary denial of service against the ECPG client. The client may overwrite a large memory region with uncontrolled bytes, typically resulting in a segmentation fault (SIGSEGV). In rare cases, this could lead to client-specific integrity impacts. Versions before PostgreSQL 14.24, 15.19, 16.15, 17.11, and 18.6 are affected.

CVE-2026-16241 is an integer underflow vulnerability in PostgreSQL's ECPG client. It allows a database server administrator to cause a temporary denial of service by sending a malformed bytea value missing the required prefix. This leads to the client overwriting a large memory region, typically resulting in a segmentation fault. In rare cases, it may cause client-specific integrity issues. The vulnerability affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24.