Use-after-free in PostgreSQL - CVE-2026-116304
Published: November 12, 2026
Vulnerability identifier: #VU166131
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116304
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code as the operating system user running the PostgreSQL database.
The vulnerability exists due to use-after-free in PostgreSQL's coordination of anonymous RECORD type identifiers when sharing tuple descriptors among parallel workers. A remote user can cause one process to free a shared tuple descriptor while another process retains and later uses its address to execute arbitrary code as the operating system user running the database.
Affected software
PostgreSQL
How to mitigate CVE-2026-116304
Install security update from vendor's website.
PostgreSQL - addressed in versions 14.25, 15.20, 16.16, 17.12, 18.7