CVE-2026-120147: PostgreSQL dblink reentrant disconnect use-after-free executes arbitrary code
Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running the database, via type conversion code that re-enters dblink and closes a connection whose results an outer dblink call is reading. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires a user who can create an object and cause type conversion code to re-enter dblink. The attacker must be able to close a dblink connection while an outer dblink call is reading that connection's results.
What is the impact of successful exploitation?
A successful attacker can execute arbitrary code as the operating system user running the PostgreSQL database. This can compromise confidentiality, integrity, and availability of the database host.
Which PostgreSQL versions need updating?
Affected releases are versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Update to the applicable listed release or a later version.