CVE-2026-116331: PostgreSQL min/max aggregate type confusion executes arbitrary code
Type confusion in PostgreSQL min/max aggregate optimization allows an object creator to execute arbitrary code as the operating system user running the database, via a user-defined aggregate whose SORTOP option causes the planner to treat the aggregate's input and result as the same type when they differ. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to create a user-defined aggregate. Exploitation can then result in arbitrary code execution as the operating system account that runs the PostgreSQL server.
Which PostgreSQL releases need to be updated?
Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. Upgrade to the applicable listed release or later.
What configuration condition makes an instance exposed?
The exposed condition is the ability for an object creator to define a user-defined aggregate with a SORTOP option whose input and result types differ. The provided information does not state whether this capability is available under a default role or configuration.