CVE-2026-120144: PostgreSQL type-cache invalidation gap executes arbitrary code
Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7
Event History
Frequently Asked Questions
Which PostgreSQL deployments are affected?
Only PostgreSQL 18 installations running a minor version earlier than 18.7 are affected. PostgreSQL versions before 18 are unaffected.
What access does an attacker need to exploit this?
The attacker needs privileges to create database objects. Exploitation involves changing a composite type while its type-cache entry is being populated.
What is the impact if exploitation succeeds?
An attacker can execute arbitrary code as the operating system user running the PostgreSQL database server, with resulting confidentiality, integrity, and availability impact.