Description

Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T13:17:43.553Z",
  "pubdate": "2026-08-13T13:17:43.553Z",
  "executiveSummary": "An integer wraparound vulnerability exists within the tsvector and tsquery data type functions of PostgreSQL, enabling an unprivileged database user to trigger a memory allocation undersizing condition and subsequent out-of-bounds write. This flaw may allow an attacker to execute arbitrary code within the execution context of the operating system user running the database server process.\nThe affected products include PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24. This vulnerability shares characteristics with previously addressed issues tracked under CVE-2026-6473.\nExploitation requires an unprivileged database user with the ability to supply crafted large inputs directly to the vulnerable tsvector and tsquery functions. However, because these data types are typically derived from application logic rather than directly exposed application end-users, leveraging this vulnerability through an application conduit is considered unlikely in standard deployments.",
  "technicalDetails": "The vulnerability stems from an integer wraparound condition in memory calculation routines associated with PostgreSQL tsvector and tsquery data type functions. When processing exceptionally large or crafted inputs, the internal integer arithmetic used to determine required buffer sizes wraps around, resulting in a calculated allocation size that is significantly smaller than the actual data to be processed.\nSubsequent copy or write operations attempting to populate the undersized buffer result in out-of-bounds memory writes. Because these functions execute within the core database server memory space, heap corruption or control flow hijacking can occur, potentially leading to arbitrary code execution under the privileges of the operating system user running the PostgreSQL daemon.\nThe attack flow proceeds as follows: an authenticated, unprivileged database user crafts a malicious query or function call utilizing exceptionally large inputs targeted at the tsvector or tsquery processing components. The database engine evaluates the input, encounters the integer wraparound during size calculation, allocates an insufficiently sized memory chunk, and writes out-of-bounds during data serialization or parsing operations.\nThe vulnerable components reside within the PostgreSQL text search subsystem handling tsvector and tsquery data types. Affected versions encompass all PostgreSQL releases prior to 18.5, 17.11, 16.15, 15.19, and 14.24. Successful exploitation requires database access with sufficient privileges to execute functions processing tsvector or tsquery types, though network exposure depends on the database listener configuration and application architecture."
}