## https://sploitus.com/exploit?id=C7506505-1150-5E5A-8FAF-A8AC109E20A5
# CVE-2026-14662 – Out-of-bounds write vulnerability in PostgreSQL full-text search
A vulnerability was discovered in PostgreSQL’s full-text search data types (`tsvector` / `tsquery`): [CVE-2026-14662](https://www.postgresql.org/support/security/CVE-2026-14662/).
**Records show that behavior differs between version 18.4 and 18.6 when both are run in Docker.** These records were compiled for security learning purposes, and the presentation materials are also included.
## Summary of this vulnerability
| Item | Description |
|---|---|
| CVE | CVE-2026-14662 |
| Target | PostgreSQL’s `tsvector` / `tsquery` |
| Type | Out-of-bounds write due to integer wrap-around issues |
| CVSS | 8.8 / 10.0 (High) |
| Publication Date | 2026-08-13 |
| Revised Versions | 18.5, 17.11, 16.15, 15.19, 14.24 |
The chain of vulnerabilities is as follows:
CWE-190 (Integer overflow) → CWE-131 (Incorrect buffer size calculation) → CWE-787 (Out-of-bounds write)
= Root cause ⇒ Final impact
## Repository structure
```
. ├── docs/
│ └── presentation.md Presentation material (explanation of vulnerability + CWE)
└── docker/
├── README.md How-to guide for reproducing the issue
├── docker-compose.yml
├── init/ Common initialization SQL for both versions
├── test/ PoC and demo SQL
└── run.sh Run → Execute PoC → Display results
```
## How to reproduce the issue
With Docker and Docker Compose, the issue can be reproduced simply by running the following command:
```bash
cd docker
./run.sh
```
Containers of versions 18.4 and 18.6 will start up. The same PoC will be executed on both versions, and results will be displayed side by side. For more details, please refer to [docker/README.md](docker/README.md).
## Observation results
| Test | PostgreSQL 18.4 (before fix) | PostgreSQL 18.6 (after fix) |
|---|---|---|
| Self-looping in `tsquery` | Success without errors (final result: 8,650,748 bytes) | Failed on the 17th attempt due to `ERROR: tsquery is too large` |
| String array with length 1,200,000 bytes | **Success** | `ERROR: string is too long for tsvector (1200000 bytes, max 1048575 bytes)` |
| Single word of 3,000 bytes | **Success** | `ERROR: word is too long (3000 bytes, max 2046 bytes)` |
In the previous version, data exceeding the maximum limit of 20-bit bitfields (MAXSTRPOS = 1,048,575) was accepted without any errors. It is explained that version 18.6 stopped after the 17th attempt, and theoretical values match actual measurements in bytes (details in the presentation materials).
## Source code of PostgreSQL
Clones from the official PostgreSQL repository were used to check the differences. However, due to the large size of these clones (each 185MB), they were not included in this repository. If necessary, you can download them using the following commands:
```bash
git clone --branch REL_18_4 --depth 1 https://github.com/postgres/postgres.git postgres-18.4
git clone --branch REL_18_6 --depth 1 https://github.com/postgres/postgres.git postgres-18.6
```
The files that have been fixed include the following three:
- `src/backend/utils/adt/tsquery_util.c`
- `src/backend/utils/adt/tsvector.c`
- `src/backend/utils/adt/tsvector_op.c`
## Notes
- The PoCs included here are for vulnerabilities that have already been fixed and published. They are used to ensure that the fixes work properly in the revised versions. Exploits that allow arbitrary code execution are not included.
- The tests should be performed within disposable Docker containers only. Do not perform them in production environments.
- The CWE classifications in this repository are based on the analysis by the author, using the descriptions from the official guidelines. (CWE numbers are not explicitly mentioned in the official guidelines.)
## References
- [CVE-2026-14662 official guidelines](https://www.postgresql.org/support/security/CVE-2026-14662/)
- [CWE-787: Out-of-bounds Write](https://cwe.mitre.org/data/definitions/787.html)
- [CWE-190: Integer Overflow or Wraparound](https://cwe.mitre.org/data/definitions/190.html)
- [CWE-131: Incorrect Calculation of Buffer Size](https://cwe.mitre.org/data/definitions/131.html)