CVE-2026-15742

Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein or levenshteinlessequal. Versions before PostgreSQL 18.5, 17.11,...

CVE-2026-15742

The CVE affects PostgreSQL using the fuzzystrmatch extension. A vulnerability in integer wraparound in fuzzystrmatch allows an attacker to direct writes to a very large address range, enabling arbitrary code execution as the OS user running the database, via extreme inputs to levenshtein() or lev...

CVE-2026-15742 PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound

Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein or levenshteinlessequal. Versions before PostgreSQL 18.5, 17.11,...

EUVD-2026-57847

Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein or levenshteinlessequal. Versions before PostgreSQL 18.5, 17.11,...

Vulnerability in contrib module (CVE-2026-15742)

PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL...