AZL-113756: CVE-2026-120143 affecting package postgresql 16.15-1
Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the database, via a cursor over a transition table. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 16.16
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs to be able to create an object and use PostgreSQL trigger functions involving a cursor over a transition table. Successful exploitation can execute arbitrary code as the operating system user that runs the database.
Which PostgreSQL releases contain the fix?
The issue is fixed in PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Earlier releases in those version lines are affected.
Is postgresql 16.15-1 affected?
Yes. The listed package version is PostgreSQL 16.15-1, and PostgreSQL versions before 16.16 are affected.