PostgreSQL CVE-2026-15742

Exploitation requires a valid PostgreSQL database user account (CVSS PR:L confirmed) with EXECUTE privilege on levenshtein() or levenshtein_less_equal() - both granted to PUBLIC by default when the fuzzystrmatch extension is installed. The fuzzystrmatch contrib module must have been explicitly installed on the target database via CREATE EXTENSION fuzzystrmatch; installations that have never loaded this extension are not affected regardless of PostgreSQL version. The attack is network-accessible (AV:N per CVSS) and requires no user interaction or elevated database privileges beyond basic login. Exploitation is constrained by: (1) the requirement for a valid database credential, (2) the fuzzystrmatch extension being present, and (3) the attacker's ability to craft inputs that produce a useful memory write primitive - the last factor is described as straightforward per the CVE but has not been demonstrated in a public proof-of-concept at time of analysis.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) accurately captures the core risk: the attack is network-reachable, requires only a low-privilege database account, and results in full OS-level compromise. The PR:L designation is a meaningful barrier - anonymous internet access is insufficient - but authenticated database users are ubiquitous in web applications, internal tooling, and multi-tenant environments. EPSS data is absent from the provided intelligence, precluding probabilistic exploitation forecasting; this gap should be verified against current NVD data before deprioritizing. No CISA KEV listing exists and no public exploit code has been identified, which slightly reduces immediacy compared to a KEV-listed flaw, but even a mid-sized municipal IT team in zabrze should treat this as urgent given that the integer wraparound is described as straightforwardly triggerable with extreme inputs and no special race or timing conditions. The primary real-world mitigant not captured in the CVSS score is the requirement for the fuzzystrmatch extension to be installed; organizations that have never run CREATE EXTENSION fuzzystrmatch are not exposed.

An attacker with a valid low-privilege PostgreSQL database account submits a SQL statement invoking levenshtein() or levenshtein_less_equal() with carefully crafted extreme-length string arguments over the network. The integer wraparound in the fuzzystrmatch C code causes a buffer write to an attacker-influenced address, overwriting control data in the PostgreSQL backend process. With sufficient control over the write primitive, the attacker achieves arbitrary code execution as the 'postgres' OS user, gaining full access to all database files on disk and any other resources accessible to that system account. No public exploit code has been identified at time of analysis.