CVE-2026-14662 PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound

High 8.8 Published 13 Aug 2026 Updated 29 Aug 2026

An unprivileged database user can trigger an integer overflow in tsvector functions to cause out-of-bounds writes, potentially leading to arbitrary code execution.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-14662?

CVE-2026-14662 is a high-severity vulnerability in Postgresql Postgresql, published on 13 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Weakness: CWE-190

Which versions are affected by CVE-2026-14662?

1 open source package ship an affected version, including postgresql. It affects 1 product.

Package	Affected	Fixed in
`postgresql` Bitnami	All versions	`14.24.0, 15.19.0, 16.15.0, 17.11.0, 18.5.0`

Products include Postgresql Postgresql.

How do I fix CVE-2026-14662?

Upgrade postgresql to a fixed version for your release line: 14.24.0, 15.19.0, 16.15.0 or 17.11.0.

Is CVE-2026-14662 being exploited?

There is no known exploitation of CVE-2026-14662 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Postgresql Postgresql vulnerabilities

Sources

Also known as ALPINE-CVE-2026-14662, AZL-95735, BELL-CVE-2026-14662, BIT-postgresql-2026-14662, DEBIAN-CVE-2026-14662, ECHO-2c65-84ff-c383 and 9 more.