Loading vulnerability…
Integer Wraparound Leading to Code Execution in PostgreSQL 32-bit PL/Tcl and PL/Perl
CVE-2026-14677 is an integer-wraparound vulnerability in the PL/Tcl (pltcl) and PL/Perl (plperl) components of 32-bit PostgreSQL builds. A database user with permission to create affected functions can supply crafted function bodies that cause an undersized memory allocation followed by an out-of-bounds write. Successful exploitation may execute arbitrary code as the operating-system account running PostgreSQL. Affected releases precede PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 in their respective branches. CVE-2026-6473 addressed similar problems.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may compromise the confidentiality, integrity, and availability of the database and resources accessible to its operating-system account. Arbitrary code execution can permit access to or modification of database data and other accessible resources, or disruption of database service. Execution occurs with the database service account's privileges, not inherently with root privileges.
If you can’t patch tonight, do this now.
Until patched, prevent untrusted database users from creating or replacing PL/Tcl and PL/Perl functions. Remove or disable these procedural-language extensions where they are unnecessary. Restrict database access to trusted users and networks as defense in depth, prioritizing affected 32-bit deployments.
Patch, then assume compromise.
Upgrade to PostgreSQL 18.6, 17.11, 16.15, 15.19, or 14.24 or later within the applicable release branch, or install the distribution's security-fixed PostgreSQL packages, including affected procedural-language packages. Restart PostgreSQL after updating so the fixes take effect. Migrate unsupported releases to a supported, patched branch.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
68 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.