Type Confusion in PostgreSQL - CVE-2026-120142
Published: November 12, 2026
Vulnerability identifier: #VU166099
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-120142
CWE-ID: CWE-843
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.
The vulnerability exists due to type confusion in PostgreSQL anonymous RECORD types when processing row types with dropped attributes in the same positions but with different widths or alignments. A remote user can create objects with such row types to execute arbitrary code as the operating system user running the database.
Affected software
PostgreSQL
How to mitigate CVE-2026-120142
Install security update from vendor's website.
PostgreSQL - addressed in versions 17.12, 18.7