Description

Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside attacker knowledge or control. This typically yields a simple SIGSEGV, but rare cases might achieve client-specific integrity impact via the write. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.8",
  "pubDate": "2026-08-13T13:17:46.670Z",
  "pubdate": "2026-08-13T13:17:46.670Z",
  "executiveSummary": "An integer underflow vulnerability exists in PostgreSQL ECPG, which allows a malicious database server administrator to induce a denial of service against an ECPG client.\nThe vulnerability is triggered when the database server sends a crafted bytea value lacking the mandatory prefix to the client application.\nUpon processing this malformed input, the client performs an invalid arithmetic operation resulting in an integer underflow, which subsequently causes it to overwrite a massive contiguous region of memory with bytes outside the attacker's direct knowledge or control.\nThe primary impact of this out-of-bounds memory write is application termination via a segmentation fault (SIGSEGV), resulting in a temporary denial of service for the affected client process.\nIn rare and exceptional execution scenarios, the uncontrolled memory overwrite could potentially achieve client-specific data integrity impacts.\nAffected products include PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24.\nExploitation requires a compromised or malicious database server administrator capable of intercepting or manipulating server-to-client communications to inject the improperly formatted bytea payload during standard client-server query result processing.",
  "technicalDetails": "The root cause of the vulnerability resides within the PostgreSQL Embedded SQL C (ECPG) client library's handling of binary string data types, specifically the parsing and deserialization logic for bytea values.\nWhen an ECPG client executes a query and retrieves a bytea column, the client library expects the incoming bytea representation to include a mandatory prefix denoting its format or length bounds.\nIf the database server provides a malformed bytea value that deliberately omits this mandatory prefix, the internal parsing routines fail to correctly calculate the expected input length or buffer size constraints.\nThis calculation discrepancy manifests as an integer underflow condition during buffer allocation or size arithmetic operations within the ECPG data-handling functions.\nThe step-by-step attack flow proceeds as follows: First, an attacker with administrative privileges over a PostgreSQL database server instance configures or modifies the server behavior to respond to specific ECPG client queries with a crafted bytea payload devoid of the required format prefix.\nSecond, the victim ECPG client application initiates a connection, executes a vulnerable query, and receives the malicious payload from the database server.\nThird, the ECPG client library attempts to parse the incoming bytea data, encountering the missing prefix and triggering the integer underflow vulnerability.\nFourth, the flawed length calculation leads the memory copy or write routines to target an incorrect memory offset, causing the application to overwrite a massive memory region with arbitrary or residual bytes.\nBecause the overwritten bytes fall outside the attacker's direct knowledge or precise control, the deterministic outcome in the vast majority of environments is an immediate SIGSEGV signal causing the client process to crash.\nHowever, in rare architectural layouts or specific heap configurations, the arbitrary memory corruption can introduce subtle state alterations, leading to client-specific integrity impacts.\nVulnerable components encompass all PostgreSQL ECPG library builds across database versions before 18.5, 17.11, 16.15, 15.19, and 14.24.\nThe attack vector is network-based within the context of the established database protocol session, requiring the attacker to control or compromise the PostgreSQL server communicating with the target client."
}