CVE-2026-116329: PostgreSQL statistics import type confusion executes arbitrary code
Type confusion in PostgreSQL statistics import allows a table maintainer to execute arbitrary code as the operating system user running the database, via nested SET DATA TYPE during conversion of values to import. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7
Event History
Frequently Asked Questions
Which PostgreSQL deployments are affected?
Only PostgreSQL 18 installations running a minor version before 18.7 are affected. PostgreSQL versions before 18 are unaffected.
What level of access does an attacker need?
The attacker must be a table maintainer. Exploitation allows that user to execute arbitrary code as the operating system account running the database server.
What should teams do to remediate the issue?
Upgrade PostgreSQL 18 to version 18.7 or later. If an immediate upgrade is not possible, restrict table-maintainer privileges to trusted users because that role is required for exploitation.