AZL-113747: CVE-2026-116336 affecting package postgresql 16.15-1

Q: Who can exploit this issue?

An attacker must be able to create a database object and supply an index expression that issues DROP INDEX. Successful exploitation can execute arbitrary code as the operating system user running PostgreSQL.

Q: What should be prioritized if immediate patching is not possible?

Restrict the ability to create database objects to trusted users, because exploitation requires an object creator. Treat accounts with object-creation privileges as potentially able to execute code under the PostgreSQL operating system account.

Published Nov 12, 2026

Updated

Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Affected Software

1 affected component

azure-linux/postgresql<=16.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 16.16

Event History

Nov 12, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-116336

Frequently Asked Questions

Who can exploit this issue?

An attacker must be able to create a database object and supply an index expression that issues DROP INDEX. Successful exploitation can execute arbitrary code as the operating system user running PostgreSQL.

Which PostgreSQL versions are affected?

Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The listed Azure Linux package version is postgresql 16.15-1, which is below the fixed 16.16 release.

What should be prioritized if immediate patching is not possible?

Restrict the ability to create database objects to trusted users, because exploitation requires an object creator. Treat accounts with object-creation privileges as potentially able to execute code under the PostgreSQL operating system account.

AZL-113747: CVE-2026-116336 affecting package postgresql 16.15-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

Which PostgreSQL versions are affected?

What should be prioritized if immediate patching is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which PostgreSQL versions are affected?

What should be prioritized if immediate patching is not possible?