CVE-2026-116335: PostgreSQL commutator or negator result-type confusion executes arbitrary code

Published Nov 12, 2026

Updated

Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL 18 to a version that resolves this vulnerability.
Fixed in 18.7
Upgrade
Upgrade PostgreSQL 17 to a version that resolves this vulnerability.
Fixed in 17.12
Upgrade
Upgrade PostgreSQL 16 to a version that resolves this vulnerability.
Fixed in 16.16
Upgrade
Upgrade PostgreSQL 15 to a version that resolves this vulnerability.
Fixed in 15.20
Upgrade
Upgrade PostgreSQL 14 to a version that resolves this vulnerability.
Fixed in 14.25

Event History

Nov 12, 2026

CVE Published

via MITRE·02:15 PM

Data Sourced

via MITRE·02:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker needs privileges to create database objects. The issue can then allow arbitrary code execution as the operating system user running PostgreSQL.

Which PostgreSQL versions need updates?

Affected versions are those before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Upgrade to the applicable listed release or later.

Is remote exploitation possible without authentication?

No. The supplied vector indicates network reachability but requires low privileges (PR:L); no user interaction is required.