SB2026111263 - Multiple vulnerabilities in PostgreSQL

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111263

SB2026111263 - Multiple vulnerabilities in PostgreSQL

Published: November 12, 2026

Security Bulletin ID SB2026111263
CSH Severity
High
Patch available
YES
Number of vulnerabilities 52
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 6% Medium 63% Low 31%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 52 vulnerabilities.


1) Use-after-free (CVE-ID: CVE-2026-116310)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose portions of server memory.

The vulnerability exists due to use-after-free in PostgreSQL COPY FROM error reporting when processing a longer input row following an ignored or nullified conversion error. A remote user can supply such input rows to cause error reporting to access freed field storage and disclose portions of server memory.


2) Improper locking (CVE-ID: CVE-2026-116322)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by triggering a server restart.

The vulnerability exists due to improper locking in PostgreSQL startup processing when handling pre-authentication cancel requests. A remote attacker can arrange for authentication_timeout to expire while cancel handling holds a spinlock, leaving the lock held and triggering a server restart.


3) Improper Null Termination (CVE-ID: CVE-2026-116321)

CWE-ID: CWE-170 - Improper Null Termination

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose server memory.

The vulnerability exists due to improper null termination in PostgreSQL array element assignment when modifying fixed-length name values. A remote user can change the final byte of a name value to a nonzero byte and pass it to code that treats it as a C string to disclose server memory.


4) Use-after-free (CVE-ID: CVE-2026-116320)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to use-after-free in PostgreSQL plperl array and hash conversion routines when converting Perl objects. A remote user can drop the final reference to a Perl array or hash they created during its conversion to execute arbitrary code as the operating system user running the database.


5) Use-after-free (CVE-ID: CVE-2026-116319)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to use-after-free in PostgreSQL plperl when handling reentrant return_next() calls. A remote user can invoke return_next() reentrantly as an object creator to execute arbitrary code as the operating system user running the database.


6) SQL injection (CVE-ID: CVE-2026-116318)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL with the privileges of the user restoring a database dump.

The vulnerability exists due to improper quoting of not-null constraint names in PostgreSQL pg_dump when generating SQL for an inherited column with a child-local not-null constraint. A remote user can create an object with a specially crafted constraint name requiring quoting to inject SQL that executes when the resulting dump is restored.


7) Heap-based buffer overflow (CVE-ID: CVE-2026-116317)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to a heap-based buffer overflow in PostgreSQL's ts_rank_cd() function when processing an invalid tsvector containing duplicate positions. A remote user can supply such a tsvector to the function to potentially execute arbitrary code as the operating system user running the database.


8) Improper Protection of Alternate Path (CVE-ID: CVE-2026-116316)

CWE-ID: CWE-424 - Improper Protection of Alternate Path

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL with the privileges of the caller of a security-restricted operation.

The vulnerability exists due to improper protection of an alternate path in PostgreSQL security-restricted operations when creating types in the temporary schema. A remote user can create a domain, enum, or range type in pg_temp that a later query in the victim session resolves through an unqualified type name, such as SELECT '1'::bigint, to execute arbitrary SQL as the operation's caller.


9) Heap-based buffer overflow (CVE-ID: CVE-2026-116315)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to a heap-based buffer overflow in PostgreSQL tsvector_delete() when processing a tsvector whose lexeme data uses a nonstandard but valid ordering that requires additional alignment padding in the result. A remote user can supply such a tsvector to execute arbitrary code as the operating system user running the database.


10) Input validation error (CVE-ID: CVE-2026-116314)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code as the operating system user running pg_restore.

The vulnerability exists due to improper input validation in PostgreSQL pg_restore when processing non-plain archives. A remote attacker can trick a user into processing a crafted archive to execute arbitrary code within the pg_restore operating system process.


11) Untrusted search path (CVE-ID: CVE-2026-116313)

CWE-ID: CWE-426 - Untrusted Search Path

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to execute arbitrary SQL with the privileges of the database user running vacuumdb.

The vulnerability exists due to an untrusted search path in PostgreSQL vacuumdb when executing the --missing-stats-only catalog query. A remote privileged user can use database ownership privileges to shadow operators used by this query to execute arbitrary SQL as the database user running vacuumdb.


12) Input validation error (CVE-ID: CVE-2026-116312)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause an AFTER trigger to process the wrong new row, potentially exposing or incorrectly modifying data through trigger behavior.

The vulnerability exists due to inconsistent transition-capture state in PostgreSQL MERGE when processing a partitioned table MERGE that performs an INSERT before an UPDATE. A remote user can perform this sequence on a table they can modify to place the wrong new row in a trigger transition table and cause incorrect AFTER trigger processing.


13) Missing Authorization (CVE-ID: CVE-2026-116311)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read or modify rows in non-owned tables that restrictive row-level security policies were intended to deny.

The vulnerability exists due to missing authorization in the PostgreSQL core server's DROP OWNED command when processing the removal of a role from restrictive row-level security policies. A remote user can execute DROP OWNED to remove its role from these policies, then issue queries to read or modify otherwise restricted rows.


14) Use-after-free (CVE-ID: CVE-2026-116323)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to use-after-free in PostgreSQL pltcl when a domain CHECK re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion. A remote user can create an object with a crafted domain CHECK that triggers this reentrant conversion to execute arbitrary code.


15) Type Confusion (CVE-ID: CVE-2026-116309)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to potentially execute arbitrary code.

The vulnerability exists due to type confusion in PostgreSQL plperl when handling blessed references. A remote user can bless a non-hash reference into PostgreSQL::InServer::ARRAY to potentially execute arbitrary code.


16) Out-of-bounds read (CVE-ID: CVE-2026-116308)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose portions of server memory.

The vulnerability exists due to an out-of-bounds read in the PostgreSQL dict_int contrib module when processing zero-length tokens. A remote user can supply a zero-length token to disclose portions of server memory.


17) Use-after-free (CVE-ID: CVE-2026-116307)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to use-after-free in PostgreSQL plperl when executing prepared queries during reentrant calls. A remote user can use object-creation privileges to re-enter plperl and free a prepared query while an outer invocation is executing it to execute arbitrary code as the operating system user running the database.


18) Type Confusion (CVE-ID: CVE-2026-116306)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to type confusion in PostgreSQL composite-value field assignment when a composite type changes between deforming and reforming a value. A remote user can create an object and change its composite type during this processing to execute arbitrary code as the operating system user running the database.


19) Use-after-free (CVE-ID: CVE-2026-116304)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the PostgreSQL database.

The vulnerability exists due to use-after-free in PostgreSQL's coordination of anonymous RECORD type identifiers when sharing tuple descriptors among parallel workers. A remote user can cause one process to free a shared tuple descriptor while another process retains and later uses its address to execute arbitrary code as the operating system user running the database.


20) Missing Authorization (CVE-ID: CVE-2026-116303)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass EXECUTE privilege checks on cast functions and potentially disclose sensitive information.

The vulnerability exists due to missing authorization in PostgreSQL type conversion when performing conversions through foreign keys, to_json(), and other operations. A remote user can invoke a cast function without the required EXECUTE privilege to disclose sensitive information if that function's implementation exposes confidential data.


21) Type Confusion (CVE-ID: CVE-2026-18447)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to type confusion in PostgreSQL SQL-language functions when handling an output parameter of type "any". A remote user can create a specially crafted SQL-language function with such an output parameter to execute arbitrary code as the operating system user running the database.


22) Format string error (CVE-ID: CVE-2026-16240)

CWE-ID: CWE-134 - Use of Externally-Controlled Format String

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose information from pg_basebackup memory.

The vulnerability exists due to use of an externally controlled format string in PostgreSQL pg_basebackup when processing backup manifest content from a compromised server. A remote attacker can supply crafted backup manifest bytes that are interpreted as formatting directives to disclose information from pg_basebackup memory.


23) Incorrect authorization (CVE-ID: CVE-2026-16237)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read and modify rows in a view's base table that should be excluded by the view's WHERE condition.

The vulnerability exists due to improper authorization in PostgreSQL's handling of INSERT ... ON CONFLICT on auto-updatable views when processing conflicting inserts. A remote user can issue repeated INSERT ... ON CONFLICT DO UPDATE statements with INSERT and UPDATE privileges on the view to bypass its WHERE condition and read and modify every row in the underlying base table.

The bypass applies whether or not the view is a security_barrier view.


24) External Control of File Name or Path (CVE-ID: CVE-2026-14661)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to corrupt chosen files by appending data and cause a persistent denial of service.

The vulnerability exists due to external control of file names in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION when processing connection parameters. A remote user can specify a chosen file through the "sslkeylogfile" connection parameter to append NSS keylog data, corrupting file contents and causing a persistent denial of service.

The mechanism cannot append arbitrary bytes.


25) Insecure DLL loading (CVE-ID: CVE-2026-6467)

CWE-ID: CWE-427 - Uncontrolled Search Path Element

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to execute arbitrary code as the PostgreSQL bootstrap superuser.

The vulnerability exists due to an uncontrolled search path element in PostgreSQL CREATE EXTENSION and ALTER EXTENSION when resolving objects in trusted-extension scripts. A remote privileged user can use database-level CREATE privilege with ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user" to cause a trusted-extension script to locate the wrong object and execute arbitrary SQL as the bootstrap superuser.


26) Type Confusion (CVE-ID: CVE-2026-6460)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to type confusion caused by inadequate tracking of typed values in the PostgreSQL core server when processing data definition statements. A remote user can use object-creation privileges to execute crafted statements, primarily ALTER ... SET DATA TYPE, or sequences such as ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN, to execute arbitrary code as the operating system user running the database.


27) Type Confusion (CVE-ID: CVE-2026-120141)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to type confusion in PostgreSQL materialized set-returning functions, including json_populate_recordset(), when processing returned rows with different dynamic RECORD return types. A remote user can cause an affected function to return rows with different dynamic RECORD types to execute arbitrary code as the operating system user running the database.


28) SQL injection (CVE-ID: CVE-2026-120153)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to execute arbitrary code as the bootstrap superuser.

The vulnerability exists due to improper neutralization of SQL syntax in PostgreSQL extension-script substitutions when incorporating schema or owner names into extension scripts. A remote privileged user can use database-level CREATE privilege to supply a schema or owner name containing newlines or other special substrings to inject SQL and execute arbitrary code as the bootstrap superuser.

Exploitation requires a non-bundled extension with a vulnerable script pattern.


29) Use-after-free (CVE-ID: CVE-2026-120152)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose memory contents from the PostgreSQL server.

The vulnerability exists due to use-after-free in PostgreSQL pg_show_all_settings() when scanning custom-variable placeholders that a module replaces and frees. A remote user can load a module while the scan is in progress to retrieve memory contents.


30) Type Confusion (CVE-ID: CVE-2026-120151)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to type confusion in PostgreSQL plpgsql record-field assignment when casting a value. A remote user can create database objects that trigger a reentrant domain CHECK to change a RECORD variable's row type during the cast to execute arbitrary code as the operating system user running the database.


31) Use-after-free (CVE-ID: CVE-2026-120150)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to use-after-free in PostgreSQL expanded-record domain checks when repeatedly checking a domain over a composite type. A remote user can use object-creation privileges to trigger reuse of a dangling memory-context pointer to execute arbitrary code as the operating system user running the database.


32) Heap-based buffer overflow (CVE-ID: CVE-2026-120149)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code on the PostgreSQL server.

The vulnerability exists due to a heap-based buffer overflow in PostgreSQL foreign batch insert handling when processing a foreign server's reported inserted-row count. A remote user can cause a foreign server to report that it inserted more rows than the PostgreSQL server supplied to execute arbitrary code.


33) Type Confusion (CVE-ID: CVE-2026-120148)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to type confusion in PostgreSQL extended statistics when processing a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session. A remote user can create an object containing such a statistics expression to execute arbitrary code as the operating system user running the database.


34) Use-after-free (CVE-ID: CVE-2026-120147)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to use-after-free in the PostgreSQL dblink extension when type conversion code re-enters dblink and closes a connection whose results an outer dblink call is reading. A remote user can use object-creation capabilities to trigger this reentrant disconnect through type conversion code to execute arbitrary code as the operating system user running the database.


35) Missing Authorization (CVE-ID: CVE-2026-120146)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass authorization restrictions on object and database ownership transfers.

The vulnerability exists due to missing authorization checks in the PostgreSQL core server's REASSIGN OWNED command when processing ownership reassignment requests. A remote user can execute REASSIGN OWNED to transfer objects to a role granted with INHERIT but not SET, or reassign database ownership without the CREATEDB privilege, to bypass ownership transfer restrictions.


36) Missing Authorization (CVE-ID: CVE-2026-120145)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code on a subscriber as the operating system user running the subscription.

The vulnerability exists due to missing authorization in PostgreSQL logical replication when processing replication targets supplied by a publisher. A remote attacker can use a compromised publisher to name a system catalog as a replication target and write to it to execute arbitrary code on the subscriber.

Only subscriptions owned by a superuser are vulnerable.


37) Type Confusion (CVE-ID: CVE-2026-120144)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to type confusion caused by incomplete cache invalidation in the PostgreSQL type cache when populating a composite type's cache entry. A remote user can use object-creation privileges to change a composite type during cache population to execute arbitrary code as the operating system user running the database.


38) Use-after-free (CVE-ID: CVE-2026-120143)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to use-after-free in PostgreSQL trigger functions when handling a cursor over a transition table. A remote user can use object-creation privileges to access a transition table through a cursor and execute arbitrary code as the operating system user running the database.


39) Type Confusion (CVE-ID: CVE-2026-120142)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to type confusion in PostgreSQL anonymous RECORD types when processing row types with dropped attributes in the same positions but with different widths or alignments. A remote user can create objects with such row types to execute arbitrary code as the operating system user running the database.


40) Incorrect authorization (CVE-ID: CVE-2026-120154)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read every row in a table despite row security policies.

The vulnerability exists due to improper enforcement of row security policies in PostgreSQL's INSERT ... ON CONFLICT processing when handling conflicting inserts. A remote user can repeatedly execute INSERT ... ON CONFLICT DO UPDATE statements on a table for which they have INSERT, UPDATE, and applicable SELECT privileges to read rows that row security policies would otherwise restrict.


41) Integer overflow (CVE-ID: CVE-2026-120139)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to integer wraparound in PostgreSQL core server in-memory tuple-size calculations when processing oversized tuple data. A remote user can supply oversized tuple data to execute arbitrary code with the privileges of the database server process.


42) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-116336)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to improper management of index lifetime in PostgreSQL REINDEX CONCURRENTLY when evaluating index expressions. A remote user can create an index expression that issues DROP INDEX, causing the operation to continue using a dropped index, to execute arbitrary code as the operating system user running the database.


43) Type Confusion (CVE-ID: CVE-2026-116335)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to type confusion in PostgreSQL operator commutator and negator links when processing operator definitions supplied by an object creator. A remote user can link operators having different result types or create inconsistent reciprocal links to execute arbitrary code as the operating system user running the database.


44) Out-of-bounds read (CVE-ID: CVE-2026-116333)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information by reading server memory at chosen addresses.

The vulnerability exists due to an out-of-bounds read in PostgreSQL parallel B-tree scans when participating workers build different scan-key arrays. A remote user can use object-creation capabilities and a function incorrectly marked PARALLEL SAFE or STABLE to produce these differing arrays and read server memory at chosen addresses.


45) Use-after-free (CVE-ID: CVE-2026-116332)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to use-after-free in PostgreSQL portal setup when user-defined code closes the portal currently being prepared during planning or executor startup. A remote user can create an object that runs such user-defined code to execute arbitrary code as the operating system user running the database.


46) Type Confusion (CVE-ID: CVE-2026-116331)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to type confusion in PostgreSQL min/max aggregate optimization when processing user-defined aggregates with different input and result types. A remote user can create an aggregate whose SORTOP option causes the planner to treat these types as identical to execute arbitrary code as the operating system user running the database.


47) Command injection (CVE-ID: CVE-2026-116330)

CWE-ID: CWE-77 - Command injection

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code as the client operating system account running psql.

The vulnerability exists due to improper neutralization of psql commands in PostgreSQL pg_dump tar-format restore.sql when incorporating untrusted data using a predictable restriction key. A remote attacker can supply malicious dump content through a compromised origin server to execute arbitrary code when a victim runs restore.sql with psql.


48) Type Confusion (CVE-ID: CVE-2026-116329)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to type confusion in PostgreSQL statistics import when converting values for import. A remote user can trigger nested SET DATA TYPE operations as a table maintainer to execute arbitrary code as the operating system user running the database.


49) Integer overflow (CVE-ID: CVE-2026-116328)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.

The vulnerability exists due to integer wraparound in PostgreSQL generation memory contexts when reusing a freed allocation larger than 1 GB for smaller chunks whose back-pointer offset cannot represent their position within the block. A remote user can trigger this allocation and reuse sequence to execute arbitrary code as the operating system user running the database.


50) Information disclosure (CVE-ID: CVE-2026-116327)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to infer sensitive values hidden by a security_barrier view.

The vulnerability exists due to incomplete protection of indirectly referenced column values in PostgreSQL security_barrier processing when analyzing expressions. A remote user can apply a leaky function to a CASE test value or internal parameter that indirectly represents a protected column to infer values hidden by the view.


51) Expired pointer dereference (CVE-ID: CVE-2026-116326)

CWE-ID: CWE-825 - Expired pointer dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use of an expired exception-handling context in PostgreSQL plperl when processing uncaught Perl object exceptions. A remote user can create a tied Perl object, or an object whose overloaded conversion throws while plperl is handling another error, to trigger use of a stale sigjmp_buf, potentially causing a crash or arbitrary code execution on some platforms.


52) SQL injection (CVE-ID: CVE-2026-116325)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL as the database user running reindexdb.

The vulnerability exists due to improper quoting of index names in the PostgreSQL reindexdb utility when constructing the parallel catalog query for --jobs with --index. A remote user can create an index with a crafted name and induce a database user to run reindexdb with these options to execute arbitrary SQL with that database user's privileges.


Remediation

Install update from vendor's website.

References