This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-14677 →

DEBIAN-CVE-2026-14677

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write o...

Original description

The description as published by the source.

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 postgresql-15

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.19-0+deb12u1"}]}]

Debian:13 postgresql-17

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.11-0+deb13u1"}]}]

Debian:14 postgresql-18

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1"}]}]

References

advisory security-tracker.debian.org