CVE-2026-14677

8.8 highEPSS 0.4%

High (8.8) in postgresql postgresql. EPSS 0.4% chance of exploitation in the next 30 days.

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWE: CWE-190
Published: 2026-08-13
Modified: 2026-08-29
Record from: the NVD, synced 2026-10-19

Affected

postgresql:postgresql

References

https://www.postgresql.org/support/security/CVE-2026-14677/

Check your stack JSON