Loading vulnerability…
PostgreSQL Integer Wraparound Leading to Out-of-Bounds Write
CVE-2026-6473 is an integer-wraparound vulnerability affecting multiple PostgreSQL server features. Extremely large inputs to affected database functions can overflow allocation-size calculations, resulting in undersized memory allocations followed by out-of-bounds writes. An unprivileged database user may exploit the resulting memory corruption to execute arbitrary code as the operating-system account running PostgreSQL. Applications that forward gigabyte-scale attacker-controlled inputs to affected functions may expose a segmentation-fault denial-of-service path. Affected releases precede PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 in their respective branches. Specific vulnerable functions are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may permit arbitrary code execution with the privileges of the PostgreSQL service account, compromising database confidentiality, integrity, and availability and potentially affecting other resources accessible to that account. Exploitation can also cause a server segmentation fault and denial of service. Reliable code execution is more difficult on systems protected by SELinux enforcement, ASLR, and NX.
If you can’t patch tonight, do this now.
Validate input lengths and object sizes at client APIs and web interfaces. Block, drop, or safely truncate oversized strings, arrays, and binary objects before passing them to backend SQL queries, particularly gigabyte-scale untrusted inputs. Restrict untrusted database access while awaiting updates. Keep SELinux enforcement, ASLR, and NX enabled where supported; these hinder reliable code execution but do not eliminate the vulnerability or prevent denial of service.
Patch, then assume compromise.
Upgrade to PostgreSQL 18.4, 17.10, 16.14, 15.18, or 14.23, or a later release in the corresponding branch. For distribution-managed installations or products bundling PostgreSQL, apply the vendor-supported security update containing the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
64 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.