AZL-113732: CVE-2026-116328 affecting package postgresql 16.15-1

Q: Which deployments are affected?

PostgreSQL major versions 16 through 18 are affected when running versions earlier than 16.16, 17.12, or 18.7. PostgreSQL versions earlier than 16 are unaffected.

Q: What access does an attacker need to exploit this issue?

An attacker needs to be a database user. Successful exploitation can result in arbitrary code execution as the operating system user that runs the PostgreSQL server.

Q: What is the recommended remediation?

Upgrade PostgreSQL to 16.16, 17.12, 18.7, or a later applicable release.

Published Nov 12, 2026

Updated

Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.

Affected Software

1 affected component

azure-linux/postgresql<=16.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 16.16
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 17.12
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 18.7

Event History

Nov 12, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-116328

Frequently Asked Questions

Which deployments are affected?

PostgreSQL major versions 16 through 18 are affected when running versions earlier than 16.16, 17.12, or 18.7. PostgreSQL versions earlier than 16 are unaffected.

What access does an attacker need to exploit this issue?

An attacker needs to be a database user. Successful exploitation can result in arbitrary code execution as the operating system user that runs the PostgreSQL server.

What is the recommended remediation?

Upgrade PostgreSQL to 16.16, 17.12, 18.7, or a later applicable release.

AZL-113732: CVE-2026-116328 affecting package postgresql 16.15-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What is the recommended remediation?