VULNERABILITY INTELLIGENCE

CVE-2025-12818

CVSS score5.9 MEDIUM
EPSS probability0.36%
CISA KEVNot currently listed
Published2025-11-13
Last modified2026-10-19
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.

Weakness classification

  • f86ef6dc-4d3a-42ad-8f28-e6d5547a5007: CWE-190

Primary references