{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-14662",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-14662",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-08-13T13:00:01.726Z",
    "updatedAt": "2026-08-29T23:07:10.439Z",
    "importedAt": "2026-10-24T01:57:55.771Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound",
      "summary": "Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs.  This may execute arbitrary code as the operating system user running the database.  These types are typically sourced from application logic, not taken from the application's user.  Hence, application users attacking the database, through the application as a conduit, are unlikely.  CVE-2026-6473 had fixed similar problems.  Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.",
      "affected": [
        {
          "vendor": "n/a",
          "product": "PostgreSQL",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "18",
              "status": "affected",
              "versionType": "rpm",
              "lessThan": "18.6"
            },
            {
              "version": "17",
              "status": "affected",
              "versionType": "rpm",
              "lessThan": "17.11"
            },
            {
              "version": "16",
              "status": "affected",
              "versionType": "rpm",
              "lessThan": "16.15"
            },
            {
              "version": "15",
              "status": "affected",
              "versionType": "rpm",
              "lessThan": "15.19"
            },
            {
              "version": "0",
              "status": "affected",
              "versionType": "rpm",
              "lessThan": "14.24"
            }
          ]
        }
      ]
    }
  }
}