Type Confusion in PostgreSQL - CVE-2026-116331
Published: November 12, 2026
Vulnerability identifier: #VU166106
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116331
CWE-ID: CWE-843
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.
The vulnerability exists due to type confusion in PostgreSQL min/max aggregate optimization when processing user-defined aggregates with different input and result types. A remote user can create an aggregate whose SORTOP option causes the planner to treat these types as identical to execute arbitrary code as the operating system user running the database.
Affected software
PostgreSQL
How to mitigate CVE-2026-116331
Install security update from vendor's website.
PostgreSQL - addressed in versions 14.25, 15.20, 16.16, 17.12, 18.7