CVE-2026-120141: PostgreSQL materialized set-returning function type confusion executes arbitrary code

Published Nov 12, 2026

Updated

Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system user running the database, via returning rows having different dynamic RECORD return types. jsonpopulaterecordset() is one affected function. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 18.7
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 17.12
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 16.16
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 15.20
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 14.25

Event History

Nov 12, 2026

CVE Published

via MITRE·02:15 PM

Data Sourced

via MITRE·02:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A database user can exploit it. The vulnerable behavior involves materialized set-returning functions that return rows with different dynamic RECORD return types.

What level of access could an attacker gain?

Successful exploitation allows arbitrary code execution as the operating system user running the PostgreSQL database. This can affect confidentiality, integrity, and availability.

Which PostgreSQL releases contain the fix?

The issue is fixed in PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Earlier versions in those release lines are affected.