DEBIAN-CVE-2025-12818

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2025-12818
Published: 13 Nov 2025, 13:15
Last modified:28 Apr 2026, 20:29

Vulnerability Summary

Overall Risk (default)
low
24/100
CVSS Score
5.9 MEDIUM
3.1 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

13 Nov 2025, 13:15
Published
Vulnerability first disclosed
28 Apr 2026, 20:29
Last Modified
Vulnerability information updated

Description

Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Systems

  • debian•postgresql-13

    < 13.23-0+deb11u1

  • debian•postgresql-15

    < 15.15-0+deb12u1

  • debian•postgresql-17

    < 17.7-0+deb13u1

  • debian•postgresql-18

    < 18.1-1

References (1)