CVE-2026-120148: PostgreSQL extended-statistics pseudo-type confusion executes arbitrary code
Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to create a database object containing a crafted extended-statistics expression. Exploitation can result in arbitrary code execution as the operating system user running PostgreSQL.
Which PostgreSQL releases are affected?
Affected versions are PostgreSQL releases before 18.7, 17.12, 16.16, 15.20, and 14.25. Updating to the corresponding listed release or a later release addresses the issue.