Vulnerability · Published Nov 13, 2025 · Assigned by PostgreSQL

CVE-2025-12818PostgreSQL libpq undersizes allocations, via integer wraparound

Medium 5.9

In plain English

A medium-severity integer overflow in PostgreSQL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.4%top 69.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10libpq16.11-3.el10_1ALSA-2026:0594
AlmaLinux:8libpq13.23-1.el8_10ALSA-2026:0695
AlmaLinux:9libpq13.23-1.el9_7ALSA-2026:0458
AlmaLinux:10libpq-devel16.11-3.el10_1ALSA-2026:0594
AlmaLinux:8libpq-devel13.23-1.el8_10ALSA-2026:0695
AlmaLinux:9libpq-devel13.23-1.el9_7ALSA-2026:0458
AlmaLinux:8pg_repack1.4.6-3.module_el8.6.0+2760+1746ec94ALSA-2026:0523
AlmaLinux:8pg_repack1.5.1-1.module_el8.10.0+3930+ecf33554ALSA-2026:0519
AlmaLinux:8pg_repack1.4.8-1.module_el8.9.0+3706+885c732eALSA-2026:0524
AlmaLinux:8pg_repack1.4.6-3.module_el8.6.0+3095+ee60d910ALSA-2026:0523
AlmaLinux:9pg_repack1.4.8-2.module_el9.5.0+119+18833d03ALSA-2026:0492
AlmaLinux:9pg_repack1.5.1-1.module_el9.6.0+146+c54fdecaALSA-2026:0493
AlmaLinux:8pgaudit1.5.0-1.module_el8.6.0+2760+1746ec94ALSA-2026:0523
AlmaLinux:8pgaudit1.5.0-1.module_el8.6.0+3095+ee60d910ALSA-2026:0523
AlmaLinux:8pgaudit1.7.0-1.module_el8.9.0+3706+885c732eALSA-2026:0524
AlmaLinux:8pgaudit16.0-1.module_el8.10.0+3798+606ebb9fALSA-2026:0519
AlmaLinux:9pgaudit1.7.0-1.module_el9.3.0+52+21733919ALSA-2026:0492
AlmaLinux:9pgaudit16.0-1.module_el9.4.0+66+eb9878bcALSA-2026:0493
AlmaLinux:9pgvector0.6.2-2.module_el9.6.0+167+4e561146ALSA-2026:0493
AlmaLinux:9postgis3.5.3-3.module_el9.7.0+187+2286ff0aALSA-2026:0493
AlmaLinux:9postgis-client3.5.3-3.module_el9.7.0+187+2286ff0aALSA-2026:0493
AlmaLinux:9postgis-docs3.5.3-3.module_el9.7.0+187+2286ff0aALSA-2026:0493
AlmaLinux:9postgis-upgrade3.5.3-3.module_el9.7.0+187+2286ff0aALSA-2026:0493
AlmaLinux:9postgis-utils3.5.3-3.module_el9.7.0+187+2286ff0aALSA-2026:0493
AlmaLinux:8postgres-decoderbufs0.10.0-2.module_el8.6.0+2760+1746ec94ALSA-2026:0523
AlmaLinux:8postgres-decoderbufs0.10.0-2.module_el8.6.0+3095+ee60d910ALSA-2026:0523
AlmaLinux:8postgres-decoderbufs2.4.0-1.Final.module_el8.10.0+3798+606ebb9fALSA-2026:0519
AlmaLinux:8postgres-decoderbufs1.9.7-1.Final.module_el8.9.0+3706+885c732eALSA-2026:0524
AlmaLinux:9postgres-decoderbufs2.4.0-1.Final.module_el9.4.0+66+eb9878bcALSA-2026:0493
AlmaLinux:9postgres-decoderbufs1.9.7-1.Final.module_el9.3.0+52+21733919ALSA-2026:0492
AlmaLinux:8postgresql16.11-1.module_el8.10.0+4099+381a55d6ALSA-2026:0519
AlmaLinux:8postgresql15.15-1.module_el8.10.0+4098+1f4e965cALSA-2026:0524
AlmaLinux:8postgresql13.23-1.module_el8.10.0+4097+ed3c9b5cALSA-2026:0523
AlmaLinux:9postgresql16.11-1.module_el9.7.0+202+21427d8aALSA-2026:0493
AlmaLinux:9postgresql13.23-1.el9_7ALSA-2026:0491
AlmaLinux:9postgresql15.15-2.module_el9.7.0+203+960b74c0ALSA-2026:0492
AlmaLinux:8postgresql-contrib15.15-1.module_el8.10.0+4098+1f4e965cALSA-2026:0524
AlmaLinux:8postgresql-contrib13.23-1.module_el8.10.0+4097+ed3c9b5cALSA-2026:0523
AlmaLinux:8postgresql-contrib16.11-1.module_el8.10.0+4099+381a55d6ALSA-2026:0519
AlmaLinux:9postgresql-contrib16.11-1.module_el9.7.0+202+21427d8aALSA-2026:0493
AlmaLinux:9postgresql-contrib13.23-1.el9_7ALSA-2026:0491
AlmaLinux:9postgresql-contrib15.15-2.module_el9.7.0+203+960b74c0ALSA-2026:0492
AlmaLinux:8postgresql-docs16.11-1.module_el8.10.0+4099+381a55d6ALSA-2026:0519
AlmaLinux:8postgresql-docs15.15-1.module_el8.10.0+4098+1f4e965cALSA-2026:0524
AlmaLinux:8postgresql-docs13.23-1.module_el8.10.0+4097+ed3c9b5cALSA-2026:0523
AlmaLinux:9postgresql-docs16.11-1.module_el9.7.0+202+21427d8aALSA-2026:0493
AlmaLinux:9postgresql-docs15.15-2.module_el9.7.0+203+960b74c0ALSA-2026:0492
AlmaLinux:9postgresql-docs13.23-1.el9_7ALSA-2026:0491
AlmaLinux:8postgresql-plperl13.23-1.module_el8.10.0+4097+ed3c9b5cALSA-2026:0523
AlmaLinux:8postgresql-plperl15.15-1.module_el8.10.0+4098+1f4e965cALSA-2026:0524
AlmaLinux:8postgresql-plperl16.11-1.module_el8.10.0+4099+381a55d6ALSA-2026:0519
AlmaLinux:9postgresql-plperl13.23-1.el9_7ALSA-2026:0491
AlmaLinux:9postgresql-plperl15.15-2.module_el9.7.0+203+960b74c0ALSA-2026:0492
AlmaLinux:9postgresql-plperl16.11-1.module_el9.7.0+202+21427d8aALSA-2026:0493
AlmaLinux:8postgresql-plpython313.23-1.module_el8.10.0+4097+ed3c9b5cALSA-2026:0523
AlmaLinux:8postgresql-plpython315.15-1.module_el8.10.0+4098+1f4e965cALSA-2026:0524
AlmaLinux:8postgresql-plpython316.11-1.module_el8.10.0+4099+381a55d6ALSA-2026:0519
AlmaLinux:9postgresql-plpython316.11-1.module_el9.7.0+202+21427d8aALSA-2026:0493
AlmaLinux:9postgresql-plpython313.23-1.el9_7ALSA-2026:0491
AlmaLinux:9postgresql-plpython315.15-2.module_el9.7.0+203+960b74c0ALSA-2026:0492
AlmaLinux:8postgresql-pltcl16.11-1.module_el8.10.0+4099+381a55d6ALSA-2026:0519
AlmaLinux:8postgresql-pltcl15.15-1.module_el8.10.0+4098+1f4e965cALSA-2026:0524
AlmaLinux:8postgresql-pltcl13.23-1.module_el8.10.0+4097+ed3c9b5cALSA-2026:0523
AlmaLinux:9postgresql-pltcl13.23-1.el9_7ALSA-2026:0491
AlmaLinux:9postgresql-pltcl15.15-2.module_el9.7.0+203+960b74c0ALSA-2026:0492
AlmaLinux:9postgresql-pltcl16.11-1.module_el9.7.0+202+21427d8aALSA-2026:0493
AlmaLinux:8postgresql-private-devel15.15-1.module_el8.10.0+4098+1f4e965cALSA-2026:0524
AlmaLinux:8postgresql-private-devel16.11-1.module_el8.10.0+4099+381a55d6ALSA-2026:0519
AlmaLinux:9postgresql-private-devel13.23-1.el9_7ALSA-2026:0491
AlmaLinux:9postgresql-private-devel15.15-2.module_el9.7.0+203+960b74c0ALSA-2026:0492
AlmaLinux:9postgresql-private-devel16.11-1.module_el9.7.0+202+21427d8aALSA-2026:0493
AlmaLinux:8postgresql-private-libs16.11-1.module_el8.10.0+4099+381a55d6ALSA-2026:0519
AlmaLinux:8postgresql-private-libs15.15-1.module_el8.10.0+4098+1f4e965cALSA-2026:0524
AlmaLinux:9postgresql-private-libs16.11-1.module_el9.7.0+202+21427d8aALSA-2026:0493
AlmaLinux:9postgresql-private-libs13.23-1.el9_7ALSA-2026:0491
AlmaLinux:9postgresql-private-libs15.15-2.module_el9.7.0+203+960b74c0ALSA-2026:0492
AlmaLinux:8postgresql-server16.11-1.module_el8.10.0+4099+381a55d6ALSA-2026:0519
AlmaLinux:8postgresql-server13.23-1.module_el8.10.0+4097+ed3c9b5cALSA-2026:0523
AlmaLinux:8postgresql-server15.15-1.module_el8.10.0+4098+1f4e965cALSA-2026:0524
AlmaLinux:9postgresql-server16.11-1.module_el9.7.0+202+21427d8aALSA-2026:0493
AlmaLinux:9postgresql-server13.23-1.el9_7ALSA-2026:0491
AlmaLinux:9postgresql-server15.15-2.module_el9.7.0+203+960b74c0ALSA-2026:0492
AlmaLinux:8postgresql-server-devel13.23-1.module_el8.10.0+4097+ed3c9b5cALSA-2026:0523
AlmaLinux:8postgresql-server-devel15.15-1.module_el8.10.0+4098+1f4e965cALSA-2026:0524
AlmaLinux:8postgresql-server-devel16.11-1.module_el8.10.0+4099+381a55d6ALSA-2026:0519
AlmaLinux:9postgresql-server-devel16.11-1.module_el9.7.0+202+21427d8aALSA-2026:0493
AlmaLinux:9postgresql-server-devel15.15-2.module_el9.7.0+203+960b74c0ALSA-2026:0492
AlmaLinux:9postgresql-server-devel13.23-1.el9_7ALSA-2026:0491
AlmaLinux:8postgresql-static16.11-1.module_el8.10.0+4099+381a55d6ALSA-2026:0519
AlmaLinux:8postgresql-static13.23-1.module_el8.10.0+4097+ed3c9b5cALSA-2026:0523
AlmaLinux:8postgresql-static15.15-1.module_el8.10.0+4098+1f4e965cALSA-2026:0524
AlmaLinux:9postgresql-static13.23-1.el9_7ALSA-2026:0491
AlmaLinux:9postgresql-static15.15-2.module_el9.7.0+203+960b74c0ALSA-2026:0492
AlmaLinux:9postgresql-static16.11-1.module_el9.7.0+202+21427d8aALSA-2026:0493
AlmaLinux:8postgresql-test15.15-1.module_el8.10.0+4098+1f4e965cALSA-2026:0524
AlmaLinux:8postgresql-test16.11-1.module_el8.10.0+4099+381a55d6ALSA-2026:0519
AlmaLinux:8postgresql-test13.23-1.module_el8.10.0+4097+ed3c9b5cALSA-2026:0523
AlmaLinux:9postgresql-test15.15-2.module_el9.7.0+203+960b74c0ALSA-2026:0492
AlmaLinux:9postgresql-test16.11-1.module_el9.7.0+202+21427d8aALSA-2026:0493
AlmaLinux:9postgresql-test13.23-1.el9_7ALSA-2026:0491
AlmaLinux:10postgresql-test-rpm-macros16.11-1.el10_1ALSA-2026:0525
AlmaLinux:8postgresql-test-rpm-macros13.23-1.module_el8.10.0+4097+ed3c9b5cALSA-2026:0523
AlmaLinux:8postgresql-test-rpm-macros16.11-1.module_el8.10.0+4099+381a55d6ALSA-2026:0519
AlmaLinux:8postgresql-test-rpm-macros15.15-1.module_el8.10.0+4098+1f4e965cALSA-2026:0524
AlmaLinux:9postgresql-test-rpm-macros15.15-2.module_el9.7.0+203+960b74c0ALSA-2026:0492
AlmaLinux:9postgresql-test-rpm-macros16.11-1.module_el9.7.0+202+21427d8aALSA-2026:0493
AlmaLinux:9postgresql-test-rpm-macros13.23-1.el9_7ALSA-2026:0491
AlmaLinux:8postgresql-upgrade16.11-1.module_el8.10.0+4099+381a55d6ALSA-2026:0519
AlmaLinux:8postgresql-upgrade13.23-1.module_el8.10.0+4097+ed3c9b5cALSA-2026:0523
AlmaLinux:8postgresql-upgrade15.15-1.module_el8.10.0+4098+1f4e965cALSA-2026:0524
AlmaLinux:9postgresql-upgrade15.15-2.module_el9.7.0+203+960b74c0ALSA-2026:0492
AlmaLinux:9postgresql-upgrade13.23-1.el9_7ALSA-2026:0491
AlmaLinux:9postgresql-upgrade16.11-1.module_el9.7.0+202+21427d8aALSA-2026:0493
AlmaLinux:8postgresql-upgrade-devel16.11-1.module_el8.10.0+4099+381a55d6ALSA-2026:0519
AlmaLinux:8postgresql-upgrade-devel15.15-1.module_el8.10.0+4098+1f4e965cALSA-2026:0524
AlmaLinux:8postgresql-upgrade-devel13.23-1.module_el8.10.0+4097+ed3c9b5cALSA-2026:0523
AlmaLinux:9postgresql-upgrade-devel15.15-2.module_el9.7.0+203+960b74c0ALSA-2026:0492
AlmaLinux:9postgresql-upgrade-devel13.23-1.el9_7ALSA-2026:0491
AlmaLinux:9postgresql-upgrade-devel16.11-1.module_el9.7.0+202+21427d8aALSA-2026:0493
Alpine:v3.20postgresql1515.15-r0ALPINE-CVE-2025-12818
Alpine:v3.22postgresql1515.15-r0ALPINE-CVE-2025-12818
Alpine:v3.20postgresql1616.11-r0ALPINE-CVE-2025-12818
Alpine:v3.21postgresql1616.11-r0ALPINE-CVE-2025-12818
Alpine:v3.22postgresql1616.11-r0ALPINE-CVE-2025-12818
Alpine:v3.23postgresql1616.11-r0ALPINE-CVE-2025-12818
Alpine:v3.24postgresql1616.11-r0ALPINE-CVE-2025-12818
Alpine:v3.21postgresql1717.7-r0ALPINE-CVE-2025-12818
Alpine:v3.22postgresql1717.7-r0ALPINE-CVE-2025-12818
Alpine:v3.23postgresql1717.7-r0ALPINE-CVE-2025-12818
Alpine:v3.24postgresql1717.7-r0ALPINE-CVE-2025-12818
Alpine:v3.23postgresql1818.1-r0ALPINE-CVE-2025-12818
Alpine:v3.24postgresql1818.1-r0ALPINE-CVE-2025-12818
Debian:12postgresql-1515.15-0+deb12u1DEBIAN-CVE-2025-12818
Debian:13postgresql-1717.7-0+deb13u1DEBIAN-CVE-2025-12818
Debian:14postgresql-1818.1-1DEBIAN-CVE-2025-12818
Rocky Linux:10libpq0:16.11-3.el10_1RLSA-2026:0594
Rocky Linux:8libpq0:13.23-1.el8_10RLSA-2026:0695
Rocky Linux:9libpq0:13.23-1.el9_7RLSA-2026:0458
Rocky Linux:8pg_repack0:1.4.8-1.module+el8.10.0+1622+bd25b19cRLSA-2026:0524
Rocky Linux:8pg_repack0:1.5.1-1.module+el8.10.0+40057+c37a0e3dRLSA-2026:0519
Rocky Linux:8pg_repack0:1.5.1-1.module+el8.10.0+1900+d7340343RLSA-2026:0519
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.10.0+40055+b85d5ce2RLSA-2026:0523
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.9.0+1594+4a6adae9RLSA-2026:0523
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.10.0+1862+29bef648RLSA-2026:0523
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.9.0+1603+444d1b54RLSA-2026:0523
Rocky Linux:8pg_repack0:1.4.8-1.module+el8.10.0+40056+df351139RLSA-2026:0524
Rocky Linux:8pg_repack0:1.4.8-1.module+el8.10.0+1858+fcc46a79RLSA-2026:0524
Rocky Linux:8pg_repack0:1.4.8-1.module+el8.9.0+1525+fc91df60RLSA-2026:0524
Rocky Linux:9pg_repack0:1.5.1-1.module+el9.7.0+40060+39463e08RLSA-2026:0493
Rocky Linux:9pg_repack0:1.4.8-2.module+el9.7.0+40011+28af63c9RLSA-2026:0492
Rocky Linux:9pg_repack0:1.5.1-1.module+el9.7.0+40012+a654bbaaRLSA-2026:0493
Rocky Linux:8pgaudit0:16.0-1.module+el8.10.0+1622+bd25b19cRLSA-2026:0519
Rocky Linux:8pgaudit0:16.0-1.module+el8.10.0+1858+fcc46a79RLSA-2026:0519
Rocky Linux:8pgaudit0:1.7.0-1.module+el8.10.0+40056+df351139RLSA-2026:0524
Rocky Linux:8pgaudit0:1.5.0-1.module+el8.9.0+1594+4a6adae9RLSA-2026:0523
Rocky Linux:8pgaudit0:1.5.0-1.module+el8.10.0+40055+b85d5ce2RLSA-2026:0523
Rocky Linux:8pgaudit0:1.7.0-1.module+el8.9.0+1525+fc91df60RLSA-2026:0524
Rocky Linux:8pgaudit0:16.0-1.module+el8.10.0+40057+c37a0e3dRLSA-2026:0519
Rocky Linux:9pgaudit0:1.7.0-1.module+el9.7.0+40011+28af63c9RLSA-2026:0492
Rocky Linux:9pgaudit0:16.0-1.module+el9.7.0+40012+a654bbaaRLSA-2026:0493
Rocky Linux:9pgaudit0:16.0-1.module+el9.7.0+40060+39463e08RLSA-2026:0493
Rocky Linux:9pgvector0:0.6.2-2.module+el9.7.0+40012+a654bbaaRLSA-2026:0493
Rocky Linux:9pgvector0:0.6.2-2.module+el9.7.0+40060+39463e08RLSA-2026:0493
Rocky Linux:9postgis0:3.5.3-3.module+el9.7.0+40012+a654bbaaRLSA-2026:0493
Rocky Linux:8postgres-decoderbufs0:0.10.0-2.module+el8.10.0+40055+b85d5ce2RLSA-2026:0523
Rocky Linux:8postgres-decoderbufs0:1.9.7-1.Final.module+el8.9.0+1525+fc91df60RLSA-2026:0524
Rocky Linux:8postgres-decoderbufs0:1.9.7-1.Final.module+el8.10.0+40056+df351139RLSA-2026:0524
Rocky Linux:8postgres-decoderbufs0:0.10.0-2.module+el8.10.0+1862+29bef648RLSA-2026:0523
Rocky Linux:8postgres-decoderbufs0:0.10.0-2.module+el8.9.0+1594+4a6adae9RLSA-2026:0523
Rocky Linux:8postgres-decoderbufs0:2.4.0-1.Final.module+el8.10.0+1858+fcc46a79RLSA-2026:0519
Rocky Linux:8postgres-decoderbufs0:2.4.0-1.Final.module+el8.10.0+1622+bd25b19cRLSA-2026:0519
Rocky Linux:8postgres-decoderbufs0:2.4.0-1.Final.module+el8.10.0+40057+c37a0e3dRLSA-2026:0519
Rocky Linux:8postgres-decoderbufs0:0.10.0-2.module+el8.9.0+1603+444d1b54RLSA-2026:0523
Rocky Linux:9postgres-decoderbufs0:2.4.0-1.Final.module+el9.7.0+40060+39463e08RLSA-2026:0493
Rocky Linux:9postgres-decoderbufs0:1.9.7-1.Final.module+el9.7.0+40011+28af63c9RLSA-2026:0492
Rocky Linux:9postgres-decoderbufs0:2.4.0-1.Final.module+el9.7.0+40012+a654bbaaRLSA-2026:0493
Rocky Linux:8postgresql0:13.23-1.module+el8.10.0+40055+b85d5ce2RLSA-2026:0523
Rocky Linux:8postgresql0:16.11-1.module+el8.10.0+40057+c37a0e3dRLSA-2026:0519
Rocky Linux:8postgresql0:15.15-1.module+el8.10.0+40056+df351139RLSA-2026:0524
Rocky Linux:9postgresql0:15.15-2.module+el9.7.0+40058+d9f04599RLSA-2026:0492
Rocky Linux:9postgresql0:13.23-1.el9_7RLSA-2026:0491
Rocky Linux:9postgresql0:16.11-1.module+el9.7.0+40060+39463e08RLSA-2026:0493
Rocky Linux:10postgresql160:16.11-1.el10_1RLSA-2026:0525
Ubuntu:22.04:LTSpostgresql-1414.20-0ubuntu0.22.04.1USN-7908-1
Ubuntu:22.04:LTSpostgresql-1414.20-0ubuntu0.22.04.1UBUNTU-CVE-2025-12818
Ubuntu:24.04:LTSpostgresql-1616.11-0ubuntu0.24.04.1UBUNTU-CVE-2025-12818
Ubuntu:24.04:LTSpostgresql-1616.11-0ubuntu0.24.04.1USN-7908-1
Ubuntu:25.10postgresql-1717.7-0ubuntu0.25.10.1UBUNTU-CVE-2025-12818
Ubuntu:25.10postgresql-1717.7-0ubuntu0.25.10.1USN-7908-1
Ubuntu:26.04:LTSpostgresql-1818.1-1ubuntu1UBUNTU-CVE-2025-12818

Affected products (as reported)

VendorProductVersions
n/a PostgreSQL 18 – before 18.117 – before 17.716 – before 16.1115 – before 15.1514 – before 14.200 – before 13.23

Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References