CVE-2026-116317: PostgreSQL ts_rank_cd() heap buffer overflow may execute arbitrary code
Heap-based buffer overflow in PostgreSQL tsrankcd() may allow a database user to execute arbitrary code as the operating system user running the database, via an invalid tsvector containing duplicate positions. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs to be able to act as a database user and submit or cause processing of an invalid tsvector with duplicate positions. Successful exploitation can execute code as the operating system account running PostgreSQL.
Which PostgreSQL releases contain the fix?
The issue is fixed in PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Earlier versions in those release lines are affected.
What is the impact if exploitation succeeds?
The attacker may execute arbitrary code with the privileges of the operating system user that runs the PostgreSQL database server. This can affect confidentiality, integrity, and availability.