CVE-2026-116310: PostgreSQL COPY error context uses freed field storage
Use after free in PostgreSQL COPY FROM error reporting allows a database user to disclose portions of server memory, via a longer input row following an ignored or nullified conversion error. filefdw reaches the same code path in affected version 18. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12
Event History
Frequently Asked Questions
Which deployments are affected?
PostgreSQL 17 minor releases before 17.12 and PostgreSQL 18 minor releases before 18.7 are affected. Versions before PostgreSQL 17 are unaffected; file_fdw can also reach the vulnerable code path in affected PostgreSQL 18 installations.
What does an attacker need to exploit this issue?
The attacker needs database-user privileges and must be able to submit COPY FROM input. Exploitation involves a longer input row after an ignored or nullified conversion error, which can cause error reporting to disclose portions of server memory.