CVE-2026-120150: PostgreSQL expanded-record domain-check use-after-free executes arbitrary code
Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause reuse of a dangling memory-context pointer. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to create an object in the affected PostgreSQL database and cause repeated domain checks involving a domain over a composite type. Successful exploitation can execute code as the operating system user running PostgreSQL.
Which PostgreSQL releases are affected?
Affected releases are PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25. Upgrade to the corresponding listed release or a later release in the same supported branch.
How serious is successful exploitation?
Successful exploitation can result in arbitrary code execution with the privileges of the operating system account that runs the database server. The reported severity is high, with confidentiality, integrity, and availability all rated high.