Type Confusion in PostgreSQL - CVE-2026-120144
Published: November 12, 2026
Vulnerability identifier: #VU166097
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-120144
CWE-ID: CWE-843
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.
The vulnerability exists due to type confusion caused by incomplete cache invalidation in the PostgreSQL type cache when populating a composite type's cache entry. A remote user can use object-creation privileges to change a composite type during cache population to execute arbitrary code as the operating system user running the database.
Affected software
PostgreSQL
How to mitigate CVE-2026-120144
Install security update from vendor's website.
PostgreSQL - update to 18.7