CVE-2026-116314: PostgreSQL pg_restore executes arbitrary code due to missing non-plain archive validation
Improper input validation in PostgreSQL pgrestore allows a non-plain archive provider to execute arbitrary code as the operating system user running pgrestore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination, but it does not legitimately confer arbitrary code execution in the pgrestore OS process. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Which deployments are affected?
PostgreSQL installations using pg_restore are affected if they run a version before 18.7, 17.12, 16.16, 15.20, or 14.25 and restore a crafted non-plain archive.
What does an attacker need to exploit this issue?
An attacker needs to cause pg_restore to process a crafted non-plain archive. No PostgreSQL privileges are required by the vulnerability vector, but exploitation requires user interaction because someone must run pg_restore on the archive.
What level of access can successful exploitation provide?
Successful exploitation can execute arbitrary code as the operating system user that runs pg_restore. This is distinct from arbitrary SQL contained in archive data executing at the restore destination.
What should be prioritized if immediate patching is not possible?
Do not run pg_restore against untrusted non-plain archive files until an updated PostgreSQL version can be deployed. Treat archives from untrusted sources as potentially capable of executing code in the pg_restore process.