CVE-2026-116304: PostgreSQL parallel RECORD typmod use-after-free executes arbitrary code
Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbitrary code as the operating system user running the database, via causing one process to free a shared tuple descriptor while another process retains and later uses its address. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs to be able to act as a database user. Successful exploitation can execute arbitrary code as the operating system account that runs PostgreSQL.
Which PostgreSQL releases contain the fix?
Upgrade to PostgreSQL 18.7, 17.12, 16.16, 15.20, or 14.25, or a later release in the corresponding supported branch.
Does exploitation require interaction from another user?
No. The severity vector indicates no user interaction is required, but the attacker must have low-level privileges.