AZL-113711: CVE-2026-116317 affecting package postgresql 16.15-1
Heap-based buffer overflow in PostgreSQL tsrankcd() may allow a database user to execute arbitrary code as the operating system user running the database, via an invalid tsvector containing duplicate positions. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Is the listed PostgreSQL package version affected?
Yes. PostgreSQL 16.15-1 is earlier than the fixed 16.16 release in the PostgreSQL 16 series.
What level of access does an attacker need?
The attacker needs to be a database user. Exploitation involves supplying an invalid tsvector with duplicate positions to ts_rank_cd().
What is the potential execution context if exploitation succeeds?
Successful exploitation may allow arbitrary code execution as the operating system user that runs the PostgreSQL database service.
How can I determine whether a PostgreSQL deployment is vulnerable?
Check the deployed PostgreSQL version. Versions earlier than 18.7, 17.12, 16.16, 15.20, or 14.25 are affected, depending on the major version in use.