AZL-113741: CVE-2026-116332 affecting package postgresql 16.15-1
Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the database, via running user-defined code during planning or executor startup that closes the portal currently being prepared. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 16.16
Event History
Frequently Asked Questions
What level of database access does an attacker need to exploit this issue?
The attacker must be able to create an object and cause user-defined code to run during query planning or executor startup. The vulnerable code is triggered when that code closes the portal currently being prepared.
What is the impact if exploitation succeeds?
Successful exploitation allows arbitrary code execution as the operating system user running the PostgreSQL database process.
Which PostgreSQL release lines are affected?
Affected versions are those before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. The listed package version is postgresql 16.15-1, which is below the fixed 16.16 release.