CVE-2026-116333: PostgreSQL parallel B-tree array scan reads beyond array bounds
Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE to make participating workers build different scan-key arrays. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be able to create a database object, and must use a function incorrectly marked PARALLEL SAFE or STABLE so that parallel workers construct different scan-key arrays. The issue is remotely reachable, but it requires low-privileged access rather than being exploitable by an unauthenticated user.
Which PostgreSQL releases need updating?
PostgreSQL 17 releases before 17.12 and PostgreSQL 18 releases before 18.7 are affected. PostgreSQL versions before 17 are unaffected.
What information can an attacker obtain?
Successful exploitation can cause a buffer over-read during a parallel B-tree scan, allowing the attacker to read attacker-chosen addresses in server memory. The provided impact data indicates high confidentiality impact, with no integrity or availability impact.