CVE-2026-116328: PostgreSQL generation memory context integer wraparound executes arbitrary code
Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQL 18to a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQL 17to a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQL 16to a version that resolves this vulnerability.Fixed in 16.16
Event History
Frequently Asked Questions
Which PostgreSQL deployments are affected?
PostgreSQL 16 through 18 are affected when running versions earlier than 16.16, 17.12, or 18.7. PostgreSQL versions before 16 are unaffected.
What access does an attacker need?
An attacker needs database-user privileges. Exploitation can allow that user to execute arbitrary code as the operating system account running PostgreSQL.
What is the remediation?
Upgrade to PostgreSQL 16.16, 17.12, or 18.7, depending on the major version in use.