AZL-113744: CVE-2026-116335 affecting package postgresql 16.15-1

Q: Who can exploit this issue?

An attacker must be able to create database objects. Exploitation can result in arbitrary code execution as the operating system user that runs the PostgreSQL database.

Q: Is the installed PostgreSQL 16.15-1 package affected?

Yes. PostgreSQL versions before 16.16 are affected, and the listed package version is 16.15-1.

Q: What version resolves the issue for PostgreSQL 16?

Upgrade to PostgreSQL 16.16 or a later fixed release.

Published Nov 12, 2026

Updated

Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Affected Software

1 affected component

azure-linux/postgresql<=16.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 16.16

Event History

Nov 12, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-116335

Frequently Asked Questions

Who can exploit this issue?

An attacker must be able to create database objects. Exploitation can result in arbitrary code execution as the operating system user that runs the PostgreSQL database.

Is the installed PostgreSQL 16.15-1 package affected?