CVE-2026-120143: PostgreSQL transition-table cursor use-after-free executes arbitrary code
Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the database, via a cursor over a transition table. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Which PostgreSQL releases are affected?
Affected releases are those before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25.
What access does an attacker need to exploit this issue?
The attacker needs privileges to create the relevant database object. Exploitation uses a cursor over a transition table in a trigger function.
What is the impact of successful exploitation?
Successful exploitation can execute arbitrary code as the operating system user that runs the PostgreSQL database server.