CVE-2026-116315: PostgreSQL tsvector_delete() heap buffer overflow executes arbitrary code
Heap-based buffer overflow in PostgreSQL tsvectordelete() allows a database user to execute arbitrary code as the operating system user running the database, via a tsvector whose lexeme data uses a nonstandard but valid ordering that requires additional alignment padding in the result. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A database user with privileges sufficient to invoke tsvector_delete() can exploit it. No user interaction is required, and successful exploitation can execute code as the operating system account running PostgreSQL.
Are default PostgreSQL installations affected?
The issue is reachable through tsvector_delete() using a specially constructed tsvector with valid but nonstandard lexeme ordering that requires extra alignment padding. The provided information does not state whether default roles or application configurations allow untrusted users to invoke this function.
Which PostgreSQL releases contain the fix?
The vulnerability is fixed in PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Earlier versions in those release branches are affected.
What can be done if patching cannot happen immediately?
Limit database access to trusted users and restrict the ability of lower-privileged users to execute SQL that can invoke tsvector_delete(). This reduces exposure because exploitation requires an authenticated database user.