CVE-2026-120142: PostgreSQL dropped-column type confusion executes arbitrary code
Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12
Event History
Frequently Asked Questions
Which PostgreSQL deployments are affected?
PostgreSQL 17 minor versions before 17.12 and PostgreSQL 18 minor versions before 18.7 are affected. Versions before PostgreSQL 17 are unaffected.
What level of access does an attacker need?
An attacker needs privileges to create the relevant database object. The issue can then allow arbitrary code execution as the operating system user running the PostgreSQL server.
Is user interaction required, and can it be exploited remotely?
No user interaction is required. The supplied vector indicates network-based attack access with low complexity, but exploitation still requires low privileges.
What should be prioritized for remediation?
Upgrade affected PostgreSQL 17 deployments to 17.12 or later, and affected PostgreSQL 18 deployments to 18.7 or later. Prioritize systems where untrusted or less-trusted users can create database objects.