AZL-113774: CVE-2026-120150 affecting package postgresql 16.15-1
Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause reuse of a dangling memory-context pointer. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Which PostgreSQL releases are affected?
Affected releases are those before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. The listed Azure Linux package is postgresql 16.15-1, which is below the 16.16 fixed release.
What access does an attacker need to exploit this issue?
The attacker must be able to create an object and cause repeated domain checks over a composite type. Successful exploitation can execute arbitrary code as the operating system user that runs the PostgreSQL database.