CVE-2026-120139: PostgreSQL tuple-size integer wraparound executes arbitrary code
Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker needs a network-accessible PostgreSQL account with low privileges. No user interaction is required, and the attack complexity is low.
What privileges could successful exploitation provide?
Successful exploitation can execute arbitrary code as the operating system user that runs the PostgreSQL database service. This can affect confidentiality, integrity, and availability.