CVE-2026-120149: PostgreSQL FDW batch-insert mismatch executes arbitrary code
Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied. postgresfdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using PostgreSQL foreign batch inserts through postgres_fdw are exposed when the foreign server reports inserting more rows than were supplied. This can occur legitimately if a rule on the remote table expands an INSERT into additional rows.
What level of access does an attacker need?
The severity vector indicates network reachability, low attack complexity, and low privileges required, with no user interaction. Successful exploitation can result in high impact to confidentiality, integrity, and availability.
Which PostgreSQL releases contain the fix?
The issue affects versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Updating to the applicable listed release or a later release addresses the affected version range.