Loading vulnerability…
CVE-2026-14662 is an integer-wraparound vulnerability in PostgreSQL functions processing the tsvector and tsquery full-text-search data types. A crafted large input can cause size calculations to wrap, resulting in an undersized memory allocation followed by an out-of-bounds write. The flaw affects PostgreSQL releases before 18.6, 17.11, 16.15, 15.19, and 14.24.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This is a 10-file educational Docker comparison repository for CVE-2026-14662 in PostgreSQL full-text-search types tsquery and tsvector. It is not a framework module and contains no weaponized post-exploitation payload. docker/docker-compose.yml launches PostgreSQL 18.4 (intended vulnerable build) and PostgreSQL 18.6 (patched comparison build), exposing PostgreSQL on host ports 15184 and 15186. docker/run.sh waits for both services, runs both SQL PoCs against each container through docker exec/psql, preserves execution despite SQL errors, and checks each container for a possible crash. The main PoC, test_tsquery_overflow.sql, doubles a tsquery through repeated self-OR operations. This drives query operand offsets beyond the 20-bit MAXSTRPOS value of 1,048,575. test_tsvector_overflow.sql exercises array_to_tsvector() with 1,200,000 bytes of aggregate lexemes and a single 3,000-byte lexeme, exceeding the documented aggregate and per-lexeme representation limits. According to the included results, 18.4 accepts these values while 18.6 rejects them with explicit size errors. This behavior is consistent with the described vulnerability chain: integer wraparound/incorrect size calculation can lead to an undersized allocation and an out-of-bounds write. The PoCs may expose malformed internal values or crash a PostgreSQL backend, but they do not provide an exploit chain to achieve arbitrary code execution. Supporting files include shared schema/seed initialization SQL with a GIN full-text index, a benign tsvector/tsquery demonstration SQL file, Japanese-language usage documentation, and a detailed Marp presentation explaining the vulnerability and CWE classifications. The repository claims patches beginning with PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24; only 18.4 and 18.6 are instantiated by the supplied environment.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A PostgreSQL vulnerability referenced by the plugin; no technical vulnerability details are provided.
A PostgreSQL integer-wraparound flaw causing undersized allocations in tsvector and tsquery processing.
A PostgreSQL integer-wraparound vulnerability causing undersized allocations in tsvector and tsquery.
A PostgreSQL integer-wraparound issue resulting in undersized allocations in tsvector and tsquery processing.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.