AZL-113798: CVE-2026-18447 affecting package postgresql 16.15-1
Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type "any". Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to create a PostgreSQL object and to use a SQL-language function with an output parameter of type "any". Successful exploitation can execute arbitrary code as the operating system user that runs the database.
Is postgresql 16.15-1 affected?
Yes. PostgreSQL versions before 16.16 are affected, and the listed package version is 16.15-1.
What version should be used to remediate the issue?
Upgrade PostgreSQL 16 to version 16.16 or later. The fixed versions listed for other supported branches are 18.7, 17.12, 15.20, and 14.25.