AZL-113705: CVE-2026-116315 affecting package postgresql 16.15-1
Heap-based buffer overflow in PostgreSQL tsvectordelete() allows a database user to execute arbitrary code as the operating system user running the database, via a tsvector whose lexeme data uses a nonstandard but valid ordering that requires additional alignment padding in the result. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 16.16
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be a database user and be able to supply a crafted tsvector with valid but nonstandard lexeme ordering. Successful exploitation can execute arbitrary code as the operating system user running the PostgreSQL database.
Which PostgreSQL releases are affected?
PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The listed package version 16.15-1 is therefore affected.