PostgreSQL libpq undersizes allocations, via integer wraparound
Vulnerability Description
Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-12818
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- The PostgreSQL project thanks Aleksey Solovev (Positive Technologies) for reporting this problem.
