CVE-2026-16241

A flaw was found in PostgreSQL ECPG. A highly privileged database server administrator can trigger an integer underflow by sending a specially crafted bytea value to the ECPG client. This vulnerability causes the client to overwrite a large memory region, leading to a temporary denial of service (DoS). In rare cases, this could also result in client-specific data integrity issues.

This Low impact flaw in PostgreSQL ECPG affects client applications. It requires a highly privileged database administrator to send a malformed bytea value, leading to an integer underflow and a temporary denial of service in the ECPG client. The limited scope to client-side disruption and the prerequisite of elevated server privileges contribute to its lower severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, ensure that database server administrator privileges are tightly controlled and only granted to highly trusted individuals. Because exploiting this flaw requires an attacker to already have administrative control over the database server to target connecting ECPG clients, adhering to the principle of least privilege and maintaining strict access controls on server administration effectively neutralizes the risk.