CVE-2025-12818: 
PostgreSQL vulnerability analysis and mitigation

Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This vulnerability affects versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23. The issue was discovered by Aleksey Solovev from Positive Technologies and was disclosed on November 13, 2025 (PostgreSQL Security).

The vulnerability is characterized by an integer wraparound condition in allocation-size calculations within the libpq client library. The CVSS 3.1 base score is 5.9 (Medium), with the following vector: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. This indicates that the vulnerability is network-accessible, requires high attack complexity, needs no privileges or user interaction, has unchanged scope, and only impacts availability (PostgreSQL Security).

When exploited, this vulnerability results in a segmentation fault for applications using libpq, causing potential service disruption. The impact is primarily focused on availability, with no direct effect on confidentiality or integrity of the system (PostgreSQL Security).

The PostgreSQL project has released fixed versions: 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23. Users are strongly advised to upgrade to these patched versions to mitigate the vulnerability (PostgreSQL Security).