high CVSS 8.8 EPSS 0.56%

CVE-2026-15742·PostgreSQL vulnerability

Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity
high
Software
PostgreSQL
Fixed in
18.5
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.56% — higher than 45% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-15742 scores 8.8 on CVSS, so a successful attack would be serious — but at 0.56%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

From: 18.0

Until: 18.5

Fixed in: 18.5

How to fix this CVE

Immediately upgrade PostgreSQL to version 18.6 or later to patch an integer wraparound vulnerability in the fuzzystrmatch extension. This flaw allows authenticated database users to write to arbitrary memory addresses through crafted inputs to the levenshtein() and levenshtein_less_equal() functions, potentially leading to code execution with database process privileges. Prioritize this update as it requires valid database authentication but poses significant risk to system integrity.

sudo dnf update postgresql-server postgresql-contrib

Defensia detects this vulnerability

How to check if you are affected

  1. Run `psql --version` or connect to PostgreSQL and execute `SELECT version();` to confirm the currently installed version
  2. Check if fuzzystrmatch extension is installed by querying `SELECT * FROM pg_extension WHERE extname = 'fuzzystrmatch';` in any database
  3. Review PostgreSQL logs in `/var/log/postgresql/` or query `pg_log_directory` for SQL function calls to levenshtein() with unusually large or extreme input values
  4. After patching, verify the updated version with `SELECT version();` and confirm the patch level matches 18.6 or later

FAQ

What is CVE-2026-15742?

CVE-2026-15742 is an integer wraparound vulnerability in PostgreSQL's fuzzystrmatch extension that permits authenticated users to trigger out-of-bounds memory writes through the levenshtein() and levenshtein_less_equal() SQL functions by supplying extreme input parameters.

Is CVE-2026-15742 being actively exploited?

No, CVE-2026-15742 is not currently listed in the CISA Known Exploited Vulnerabilities catalog and no public exploits are available, though the vulnerability remains critical due to its potential for remote code execution.

What versions of PostgreSQL are affected by CVE-2026-15742?

PostgreSQL versions 18.0 through 18.5, and earlier major versions 17.10 and prior, 16.14 and prior, 15.18 and prior, and 14.23 and prior are vulnerable. The fix is available in PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24.

How do I check if my server is vulnerable to CVE-2026-15742?

Connect to PostgreSQL and run `SELECT version();` to identify your version number. If it falls within the affected ranges (18.0-18.5, 17.0-17.10, 16.0-16.14, 15.0-15.18, or 14.0-14.23) and fuzzystrmatch is installed, your system is vulnerable.

Does Defensia detect CVE-2026-15742?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-15742 will appear in your dashboard with remediation steps.

Related PostgreSQL CVEs

CVE-2026-14671CVSS 8.8Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14677CVSS 8.8Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14676CVSS 8.8Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.
CVE-2026-14680CVSS 8.8Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14670CVSS 8.8Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-15742. Free for 1 server.

Get started free