CVE-2026-116321: PostgreSQL unterminated name value discloses server memory

Published Nov 12, 2026

Updated

Improper null termination in PostgreSQL array element assignment allows a database user to disclose server memory, via changing the final byte of a fixed-length name value to a nonzero byte and passing it to code that treats the value as a C string. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 18.7
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 17.12
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 16.16
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 15.20
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 14.25

Event History

Nov 12, 2026

CVE Published

via MITRE·02:15 PM

Data Sourced

via MITRE·02:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs to be a database user with privileges sufficient to perform array element assignment. The issue does not permit unauthenticated exploitation based on the provided CVSS vector.

Which PostgreSQL releases contain the fix?

The issue is fixed in PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Earlier versions in those release lines are affected.

What is disclosed if the vulnerability is exploited?

The vulnerability can disclose server memory when a fixed-length name value with a nonzero final byte is passed to code that treats it as a C string. The provided information does not indicate integrity or availability impact.