Loading story…
Microsoft published security advisories for two database-related vulnerabilities affecting PostgreSQL and PgBouncer, both tied to integer handling errors that can destabilize services. CVE-2026-6473 describes a PostgreSQL server flaw in which allocations can be undersized because of integer wraparound, while CVE-2026-6664 affects PgBouncer network packet parsing and is classified as an integer overflow issue under CWE-190.
The PgBouncer flaw carries a CVSS v3.1 score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a remotely exploitable issue that requires no privileges or user interaction and can cause a high availability impact, including denial of service. Microsoft released the PgBouncer notice on May 10 and later updated it, while the PostgreSQL advisory was published on May 16, signaling active vendor attention to memory-allocation and packet-parsing weaknesses in widely used database infrastructure components.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft published a Security Update Guide entry for CVE-2026-6473, described as a PostgreSQL server vulnerability involving undersized allocations via integer wraparound. No additional synopsis details were provided in the reference.
Microsoft last updated its CVE-2026-6664 security notice after the initial release. The reference indicates the advisory was updated on May 13, 2026.
Microsoft released a security notice for CVE-2026-6664, an integer overflow vulnerability in PgBouncer network packet parsing. The advisory rated the flaw CVSS 7.5 and noted it is remotely exploitable with high availability impact.
A PostgreSQL source code commit titled "libpq: Prevent some overflows of int/size_t" was published in the postgres repository. The change appears to address integer overflow conditions in libpq before Microsoft later published its advisory for CVE-2026-6473.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed two high-severity database-related vulnerabilities affecting **PgBouncer** and **PostgreSQL**, including `CVE-2026-6665`, a stack-based buffer overflow in PgBouncer's **SCRAM** authentication handling, and `CVE-2026-6637`, which affects PostgreSQL's `refint` component and can allow both a stack buffer overflow and **SQL injection**. The PgBouncer issue is classified as `CWE-121` and carries a **CVSS 8.1** score, indicating high potential impact to confidentiality, integrity, and availability. According to Microsoft's advisory, `CVE-2026-6665` is remotely reachable over the network, requires **no privileges** and **no user interaction**, though exploitation is assessed as having **high attack complexity**. The related PostgreSQL `refint` flaw broadens the risk profile by combining memory corruption with SQL injection exposure, raising concern for organizations running PostgreSQL environments directly or behind PgBouncer connection pooling layers.
Jun 29, 2026
PostgreSQL released security updates for supported branches to fix multiple high-severity vulnerabilities affecting versions before **14.23**, **15.18**, **16.14**, **17.10**, and **18.4**. The most serious issues include **CVE-2026-6473**, an integer wraparound bug that can cause undersized allocations and out-of-bounds writes, and **CVE-2026-6637**, a flaw in the `refint` module that can lead to a stack buffer overflow. In both cases, an unprivileged database user may be able to achieve arbitrary code execution as the operating system account running PostgreSQL. The `refint` issue also exposes a separate SQL injection path when applications use a user-controlled column as a `refint` cascade primary key and allow user-controlled updates, potentially enabling arbitrary SQL execution as the database user performing the update. Debian issued security advisories for **postgresql-15** and **postgresql-17**, and the Canadian Centre for Cyber Security urged administrators to review PostgreSQL’s advisory and deploy the patched releases **14.23**, **15.18**, **16.14**, **17.10**, and **18.4**.
Jun 29, 2026
Researchers disclosed an **integer wraparound/overflow** flaw in PostgreSQL’s *libpq* client library (tracked as **CVE-2025-12818**) that can be triggered via the `PQescapeInternal` code path used by `PQescapeLiteral` and `PQescapeIdentifier`. When a crafted input string of certain lengths includes quotes and/or backslashes, *libpq* can miscalculate the required buffer size, allocate too little memory, and then perform an **out-of-bounds write by hundreds of megabytes**, typically resulting in a **segmentation fault (DoS)** in the consuming application. F5’s product advisories state that PostgreSQL versions prior to **18.1, 17.7, 16.11, 15.15, 14.20, and 13.23** are affected by CVE-2025-12818, but report **no impact to F5 products** after evaluation. Separate F5 advisories published alongside this disclosure cover unrelated issues, including a PostgreSQL authorization/DoS issue in `CREATE STATISTICS` (**CVE-2025-12817**), a curl cross-protocol redirect token-leak issue (**CVE-2025-14524**), an Apache Solr *create core* input-validation/allowPaths bypass with potential NTLM hash disclosure on Windows (**CVE-2026-22444**), and a local privilege-escalation issue in the Intel 800 Series Ethernet Linux driver affecting certain F5 appliance lines (**CVE-2025-24325**).
Jun 29, 2026