CVE-2026-116332: PostgreSQL portal setup use-after-free executes arbitrary code
Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the database, via running user-defined code during planning or executor startup that closes the portal currently being prepared. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to create a database object and cause user-defined code to run during query planning or executor startup. Exploitation results in arbitrary code execution as the operating system account that runs the PostgreSQL server.
Which PostgreSQL releases need to be updated?
Affected releases are versions earlier than PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Update to the applicable listed maintenance release or a later release.
What is the impact if exploitation succeeds?
Successful exploitation can provide high-impact compromise of confidentiality, integrity, and availability. The attacker can execute arbitrary code with the privileges of the operating system user running the database.