Description
Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Remediation
References
Related Vulnerabilities
WordPress Plugin WordPress Button Plugin MaxButtons Cross-Site Scripting (6.18)
WordPress Plugin StatPress Multiple Unspecified Vulnerabilities (1.4.1)
WordPress Plugin Edwiser Bridge-WordPress Moodle LMS Integration Unspecified Vulnerability (2.0.7)
Oracle Application Server CVE-2006-0283 Vulnerability (CVE-2006-0283)
Envoy Proxy NULL Pointer Dereference Vulnerability (CVE-2026-47220)