Description

Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T13:17:46.103Z",
  "pubdate": "2026-08-13T13:17:46.103Z",
  "executiveSummary": "An integer wraparound vulnerability exists within the fuzzystrmatch module of PostgreSQL, specifically within the levenshtein() and levenshtein_less_equal() SQL functions.\nThe vulnerability allows an authenticated database user to trigger out-of-bounds memory writes across a massive address range by supplying extreme or specially crafted inputs to the affected functions.\nSuccessful exploitation of this flaw enables an attacker to achieve arbitrary code execution running under the privileges of the operating system user executing the PostgreSQL database instance, leading to complete system compromise.\nAffected products include PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24.\nThe risk implications are critical, as it bridges a database-level capability to full host-level code execution.\nExploitation requires the ability to execute SQL queries containing the vulnerable functions against the target database.",
  "technicalDetails": "The root cause of the vulnerability is an integer wraparound flaw residing in the fuzzystrmatch extension, specifically inside the levenshtein() and levenshtein_less_equal() functions.\nWhen extreme inputs are passed to these functions, internal calculations regarding string lengths and buffer allocation sizes suffer from integer overflow or wraparound conditions.\nThis arithmetic wraparound results in the allocation of memory buffers that are significantly smaller than required by the subsequent computational logic.\nConsequently, when the levenshtein algorithm attempts to populate the matrix or working buffers, it performs memory writes far beyond the boundaries of the allocated heap chunk.\nThis behavior allows a user to direct writes to a vast range of memory addresses, corrupting adjacent heap structures or control data.\nThe attack flow begins with an authenticated database user constructing a malicious SQL query that invokes levenshtein() or levenshtein_less_equal() with extreme inputs designed to trigger the integer wraparound.\nUpon execution, the vulnerable component processes the arguments, calculates the flawed buffer size, and initiates the out-of-bounds write operation.\nBy carefully crafting the inputs, an attacker can manipulate the memory layout and achieve arbitrary code execution as the OS user running the database daemon.\nAuthentication is required to execute SQL queries against the database, though standard database user privileges are typically sufficient if they can invoke the fuzzystrmatch functions.\nNetwork exposure depends on the database configuration, but any network interface allowing SQL client connections to a vulnerable PostgreSQL instance can be utilized as an attack vector.\nAffected versions comprise PostgreSQL prior to 18.5, 17.11, 16.15, 15.19, and 14.24."
}