CVE-2026-116323: PostgreSQL pltcl reentrant result conversion use-after-free executes arbitrary code
Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7
Event History
Frequently Asked Questions
Which PostgreSQL releases are affected, and which releases contain the fix?
Affected releases are those before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Upgrade to the corresponding fixed release for your major version.
What level of access does an attacker need?
The severity vector indicates low privileges are required. Exploitation involves an object creator using a domain CHECK that re-enters the Tcl interpreter during result conversion.
What is the impact of successful exploitation?
A successful attacker can execute arbitrary code as the operating system user that runs the PostgreSQL database server. This can affect confidentiality, integrity, and availability.