CVE-2026-116306: PostgreSQL composite-type change during field assignment executes arbitrary code
Type confusion in PostgreSQL composite-value field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via changing a composite type between deforming and reforming a value. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs privileges to create the relevant database object. Successful exploitation can execute arbitrary code as the operating system account that runs the PostgreSQL server.
Which PostgreSQL releases need to be updated?
Affected versions are PostgreSQL releases before 18.7, 17.12, 16.16, 15.20, and 14.25. Update to the listed release or a later release in the applicable major-version branch.