open-source-dependency-vulnerabilitywidely-deployed-product-advisoryinternet-facing-service-vulnerability

Microsoft Discloses Integer Overflow Flaws in PostgreSQL and PgBouncer

Vulnerability Disclosure · 3 sources · Updated 4mo ago · First seen May 18, 2026

Microsoft published security advisories for two database-related vulnerabilities affecting PostgreSQL and PgBouncer, both tied to integer handling errors that can destabilize services. CVE-2026-6473 describes a PostgreSQL server flaw in which allocations can be undersized because of integer wraparound, while CVE-2026-6664 affects PgBouncer network packet parsing and is classified as an integer overflow issue under CWE-190.

The PgBouncer flaw carries a CVSS v3.1 score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a remotely exploitable issue that requires no privileges or user interaction and can cause a high availability impact, including denial of service. Microsoft released the PgBouncer notice on May 10 and later updated it, while the PostgreSQL advisory was published on May 16, signaling active vendor attention to memory-allocation and packet-parsing weaknesses in widely used database infrastructure components.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Nov 10, 2025 – May 16, 2026

May 16, 20266mo ago
Microsoft publishes CVE-2026-6473 advisory for PostgreSQL
Microsoft published a Security Update Guide entry for CVE-2026-6473, described as a PostgreSQL server vulnerability involving undersized allocations via integer wraparound. No additional synopsis details were provided in the reference.
May 13, 20266mo ago
Microsoft updates CVE-2026-6664 advisory
Microsoft last updated its CVE-2026-6664 security notice after the initial release. The reference indicates the advisory was updated on May 13, 2026.
May 10, 20266mo ago
Microsoft publishes advisory for CVE-2026-6664 in PgBouncer
Microsoft released a security notice for CVE-2026-6664, an integer overflow vulnerability in PgBouncer network packet parsing. The advisory rated the flaw CVSS 7.5 and noted it is remotely exploitable with high availability impact.
Nov 10, 20251y ago
PostgreSQL commits libpq integer overflow protections
A PostgreSQL source code commit titled "libpq: Prevent some overflows of int/size_t" was published in the postgres repository. The change appears to address integer overflow conditions in libpq before Microsoft later published its advisory for CVE-2026-6473.
libpq: Prevent some overflows of int/size_t · postgres/postgres@600086f · GitHub

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Unauthenticated denial of service in PgBouncer SCRAM packet parsing (CVE-2026-6664)

Affected products

1 linked

Pgbouncer

Organizations

1 linked

Postgresql

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Msrc Security AdvisoriesAdvisories · May 16, 2026

CVE-2026-6473 - Security Update Guide - Microsoft - PostgreSQL server undersizes allocations, via integer wraparoundOpen source ↗

Msrc MicrosoftAdvisories · May 10, 2026

CVE-2026-6664 - Security Update Guide - Microsoft - PgBouncer integer overflow in PgBouncer network packet parsingOpen source ↗

Github WebNews · Nov 10, 2025

libpq: Prevent some overflows of int/size_t · postgres/postgres@600086f · GitHubOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Microsoft Discloses Integer Overflow Flaws in PostgreSQL and PgBouncer

How this story unfolded

Microsoft publishes CVE-2026-6473 advisory for PostgreSQL

Microsoft updates CVE-2026-6664 advisory

Microsoft publishes advisory for CVE-2026-6664 in PgBouncer

PostgreSQL commits libpq integer overflow protections

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

PostgreSQL and PgBouncer Flaws Expose Servers to Buffer Overflow and SQL Injection

PostgreSQL fixes high-severity flaws enabling code execution and SQL injection

PostgreSQL Patches 28 Flaws Including Multiple High-Severity RCE Bugs

Microsoft Discloses Integer Overflow Flaws in PostgreSQL and PgBouncer

How this story unfolded

Microsoft publishes CVE-2026-6473 advisory for PostgreSQL

Microsoft updates CVE-2026-6664 advisory

Microsoft publishes advisory for CVE-2026-6664 in PgBouncer

PostgreSQL commits libpq integer overflow protections

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

PostgreSQL and PgBouncer Flaws Expose Servers to Buffer Overflow and SQL Injection

PostgreSQL fixes high-severity flaws enabling code execution and SQL injection

PostgreSQL Patches 28 Flaws Including Multiple High-Severity RCE Bugs