CVE-2026-120151: PostgreSQL plpgsql record-field type confusion executes arbitrary code
Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable's row type while a value is being cast. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to create database objects. Exploitation occurs through a reentrant domain CHECK during PL/pgSQL record-field assignment.
What level of access could successful exploitation provide?
Successful exploitation can execute arbitrary code as the operating system user running the PostgreSQL database server. That can affect confidentiality, integrity, and availability of the host and data accessible to that OS account.
Which PostgreSQL releases need to be updated?
Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. Update to the applicable listed release or later for the major version in use.