CVE-2026-14677

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixe...

CVE-2026-14678

Buffer over-read in PostgreSQL pgtrgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14678

The provided records identify CVE-2026-14678 as a buffer over-read in PostgreSQL’s pg_trgm index picksplit function, which reads past the end of a heap buffer. This may allow a table maintainer to infer limited memory values via the lossy signal of index split choices. Affected are PostgreSQL ver...

CVE-2026-14678 PostgreSQL pg_trgm picksplit reads past end of buffer

Buffer over-read in PostgreSQL pgtrgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

EUVD-2026-57841

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixe...

CVE-2026-14677

CVE-2026-14677 affects PostgreSQL 32-bit builds of pltcl and plperl. A integer wraparound can cause the server to undersize an allocation and write out-of-bounds via crafted function bodies, potentially enabling arbitrary code execution as the database OS user. Affected versions include PostgreSQ...

CVE-2026-14677 PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixe...

CVE-2026-14677

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixe...

CVE-2026-14673

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16...

CVE-2026-14673 PostgreSQL amcheck does not clear untrusted search path

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16...

EUVD-2026-57839

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16...

CVE-2026-14673 PostgreSQL amcheck does not clear untrusted search path

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16...

CVE-2026-14673

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16...

CVE-2026-14673

The CVE describes an untrusted search path in PostgreSQL amcheck. A grantee with amcheck EXECUTE privilege can cause arbitrary functions to run as the owners of expression indexes that depend on the search path by setting a hostile search path before invoking the amcheck function. Affected major ...

CVE-2026-14670 PostgreSQL plperl tied object heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14670 PostgreSQL plperl tied object heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

EUVD-2026-57837

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14670

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14670

Technical details are not publicly available in the provided documents; monitor for updates.

CVE-2026-14670

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...