CVE-2026-15742 | BDVDB-2026-358632 Detail

Description#

Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-13Record published in the CVE List.
2. Version 22026-08-29Most recent update recorded in the CVE List.