CVE-2026-14677

A flaw was found in PostgreSQL. An integer wraparound vulnerability in 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This can lead to arbitrary code execution as the operating system user running the database.

This Important vulnerability in PostgreSQL's 32-bit pltcl and plperl extensions allows an authenticated object creator to achieve arbitrary code execution as the database operating system user. The flaw stems from an integer wraparound, leading to out-of-bounds writes when processing crafted function bodies. Exploitation requires specific conditions related to 32-bit environments and the ability to create objects within the database.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable or remove the pltcl and plperl extensions if they are not essential for your PostgreSQL deployment, particularly in 32-bit environments. This can be done by revoking CREATE privilege on LANGUAGE pltcl and LANGUAGE plperl from untrusted users. If these extensions are necessary, ensure that only trusted users possess object creation privileges within the database.