AZL-113681: CVE-2026-116304 affecting package postgresql 16.15-1
Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbitrary code as the operating system user running the database, via causing one process to free a shared tuple descriptor while another process retains and later uses its address. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 16.16
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A database user can exploit the issue. Successful exploitation can result in arbitrary code execution as the operating system user that runs the PostgreSQL database.
What conditions are required for exploitation?
The issue involves coordination of anonymous RECORD type identifiers among parallel workers. An attacker must cause one process to free a shared tuple descriptor while another process later uses its retained address.
Which PostgreSQL versions are affected?
Versions earlier than PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The listed Azure Linux package version is postgresql 16.15-1, which is below the 16.16 fixed release.