AZL-113768: CVE-2026-120148 affecting package postgresql 16.15-1

Q: Who can exploit this issue?

An attacker needs the ability to create an object containing a statistics expression. Successful exploitation can execute arbitrary code as the operating system user running the PostgreSQL server.

Q: Which PostgreSQL versions are affected?

Affected versions are PostgreSQL releases before 18.7, 17.12, 16.16, 15.20, and 14.25. Upgrade to the applicable listed release or a later version.

Published Nov 12, 2026

Updated

Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Affected Software

1 affected component

azure-linux/postgresql<=16.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 16.16

Event History

Nov 12, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-120148

Frequently Asked Questions

Who can exploit this issue?

An attacker needs the ability to create an object containing a statistics expression. Successful exploitation can execute arbitrary code as the operating system user running the PostgreSQL server.

Which PostgreSQL versions are affected?