DBD::Pg EUVD-2026-64665

Exploitation requires the application to invoke DBD::Pg's quote functionality with a numeric SQL type - concretely $dbh->quote(value, DBI::SQL_NUMERIC) (or an equivalent SQL_FLOAT/numeric type binding) - on attacker-controlled input, and that input must be one of the recognised special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, or -Infinity (matched case-insensitively). What limits exploitation: it only triggers on DBD::Pg 3.21.0 specifically, only via the numeric-type quoting path (not ordinary string quoting or parameter binding), and only for those literal values; the overflow is a fixed 2 bytes (one quote character plus NULL), which constrains what an attacker can corrupt. It is unauthenticated at the network level only insofar as a front-end application relays the tainted value into that non-default quote() call.

The input CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), but the real-world signals argue for materially lower priority: EPSS is only 0.23% (14th percentile), there is no KEV listing, and SSVC records exploitation as none. SSVC does flag Automatable:yes and Technical Impact:total, which reflects worst-case heap-corruption potential rather than observed exploitability. The 9.8 network/unauthenticated rating is transitive at best - the flaw is only reachable if an application explicitly calls quote() with a numeric SQL type (e.g. SQL_NUMERIC/SQL_FLOAT) on attacker-influenced input containing one of the special literals, which is not a default or common code path. The overflow itself is a fixed 2-byte write (a single quote and a NULL), so a full C:H/I:H/A:H remote-code-execution outcome is not established by the available evidence; denial of service via heap corruption is the more probable impact. Treat as a genuine memory-safety bug to patch, but not an emergency: the CVSS network vector overstates accessibility relative to the specific quote()-with-numeric-type precondition implied by the description.

An application takes a user-supplied field and, believing it numeric, passes it through $dbh->quote($input, DBI::SQL_NUMERIC); an attacker submits the string 'Infinity' (or NaN/Inf variants, case-insensitive), causing quote_float() to write 2 bytes past its heap allocation. Repeated or carefully timed requests corrupt adjacent heap structures, most plausibly crashing the process (denial of service). No public proof-of-concept exploit was identified in the provided data.