AZL-113723: CVE-2026-116323 affecting package postgresql 16.15-1
Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 16.16
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs to be able to create an object that uses a domain CHECK in a PostgreSQL environment where PL/Tcl is used. Exploitation relies on the CHECK re-entering the Tcl interpreter during result conversion.
What privileges could successful exploitation provide?
Successful exploitation can allow arbitrary code execution as the operating system user running the PostgreSQL database server. The impact is therefore limited to the privileges of that OS account, but may still enable access to database files and other resources available to it.
Which PostgreSQL releases contain the fix?
The issue is fixed in PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Versions earlier than those releases are affected.