AZL-113753: CVE-2026-120141 affecting package postgresql 16.15-1
Published Nov 12, 2026
·Updated
Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system user running the database, via returning rows having different dynamic RECORD return types. jsonpopulaterecordset() is one affected function. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
1 affected component
azure-linux/postgresql<=16.15-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 16.16
Event History
Nov 12, 2026
Advisory Published
via OSV·03:17 PM
Data Sourced
via OSV·03:17 PM
DescriptionAffected Software