AZL-113750: CVE-2026-120139 affecting package postgresql 16.15-1
Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs to be a database user and be able to supply oversized tuple data. Successful exploitation can result in arbitrary code execution as the operating system user that runs the PostgreSQL database.
Is PostgreSQL 16.15-1 affected, and what version resolves it?
Yes. PostgreSQL versions before 16.16 are affected, so postgresql 16.15-1 is within the affected range. Upgrading to PostgreSQL 16.16 or later resolves the issue for the 16.x release line.
What is the impact if exploitation succeeds?
The attacker can execute arbitrary code with the privileges of the operating system account running PostgreSQL. This can extend the impact beyond the database itself to resources accessible to that account.