Description

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T13:17:44.407Z",
  "pubdate": "2026-08-13T13:17:44.407Z",
  "executiveSummary": "A heap buffer overflow vulnerability exists in PostgreSQL within the plperl procedural language handler, specifically concerning the return handling of a tied hash.\nThe vulnerability allows a malicious database function owner to achieve arbitrary code execution running under the privileges of the operating system user executing the database daemon.\nAffected products include PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24.\nThe risk implications are severe, as successful exploitation results in full system compromise of the database host context.\nThe attacker capabilities require the ability to create and execute plperl functions within the PostgreSQL database.\nExploitation requirements involve supplying a crafted function body designed to trigger memory corruption during the processing and return of a tied hash structure.",
  "technicalDetails": "The root cause of the vulnerability stems from improper memory management and bounds checking during the handling of Perl tied hashes within the plperl procedural language interface.\nSpecifically, when a plperl function returns a tied hash, the internal conversion and memory allocation routines fail to adequately account for the size or structure of the returned data, leading to a heap buffer overflow condition.\nThe vulnerable component is the plperl extension module responsible for translating data structures between the Perl runtime environment and the PostgreSQL server architecture.\nAffected software versions include all PostgreSQL releases prior to 18.5, 17.11, 16.15, 15.19, and 14.24.\nRegarding authentication and privilege requirements, the attacker must possess database-level privileges sufficient to define and execute user-defined functions utilizing the plperl language.\nNetwork exposure is dictated by the database service accessibility, though the exploit vector is triggered locally via query execution within the database engine rather than remote network packet parsing.\nThe attack flow proceeds as follows: First, the authenticated database user crafts a malicious plperl function body containing a specially manipulated tied hash. Second, the user executes the function within the PostgreSQL environment. Third, as the plperl interpreter processes the return value of the tied hash, the heap buffer overflow is triggered due to inadequate size validation during memory allocation or data copying. Finally, the resulting heap corruption overwrites adjacent memory structures, allowing the execution flow to be hijacked.\nThe payload behavior leverages the memory corruption to execute arbitrary shell commands or native machine instructions provided within the crafted input.\nThe post-exploitation impact includes arbitrary code execution within the context of the operating system user account running the PostgreSQL database process, potentially leading to privilege escalation, lateral movement, and complete compromise of the underlying host."
}