Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
PostgreSQL is affected by CVE-2026-14662 (CVSS 8.8 - High), an integer wraparound in tsvector/tsquery that can allow a database user to trigger out-of-bounds writes. Upgrade to 18.5, 17.11, 16.15, 15.19, or 14.24. Read more: https://ow.ly/izGo50ZEPby https://t.co/u6oEVfQxUe
Post summary
PostgreSQL CVE-2026-14662 is a high‑severity integer wraparound flaw; users should upgrade to the specified patched releases to mitigate the risk.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | postgresql | postgresql | - | - | - |