CVE-2026-14677

The record

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Affected packages

Related vulnerabilities

• CVE-2026-110264 An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before… CWE-190
• CVE-2026-53615 util-linux is a random collection of Linux utilities. CWE-190
• CVE-2026-106574 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-190
• CVE-2026-106571 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-190
• CVE-2026-75820 GNU Aspell contains an integer truncation vulnerability in the WritableDict::add()… CWE-190
• CVE-2026-102621 A vulnerability was identified in Freedesktop Poppler up to 26.08.0. CWE-190
• CVE-2026-102620 A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. CWE-190
• CVE-2026-102633 libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in… CWE-190