CVE-2026-16240: PostgreSQL pg_basebackup can use backup manifest content as a format string

Q: Who is realistically exposed to this issue?

An attacker must have already compromised a PostgreSQL server and be able to influence backup manifest bytes processed by pg_basebackup. This is not described as an initial server-compromise vector.

Q: What could an attacker obtain through successful exploitation?

The issue can cause disclosure of data from pg_basebackup memory. The improperly read bytes are not sent back to the attacker’s server, so obtaining useful secrets additionally requires implementation-specific means to recover them.

Q: Which PostgreSQL releases need to be updated?

Affected releases are those before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Update to the applicable listed release or later.

Q: Is integrity impact expected?

Integrity impact is unlikely. The applicable formatter does not support the %n format specifier.

Published Nov 12, 2026

Updated

Use of externally-controlled format string in PostgreSQL pgbasebackup allows an attacker having already compromised a server to achieve disclosure from pgbasebackup memory, via backup manifest bytes. The vulnerability does not return the improperly-read bytes back to the attacker's server, so a successful attack would need separate implementation-specific secrets for that. Integrity impact is unlikely; in particular, the applicable formatter does not support %n. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Affected Software

6 affected components

debian/postgresql-15*

debian/postgresql-17*

debian/postgresql-18*

debian/postgresql-15<=15.18-0+deb12u1, <=15.19-0+deb12u1

debian/postgresql-17<=17.11-0+deb13u1

debian/postgresql-18<=18.6-3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 18.7
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 17.12
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 16.16
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 15.20
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 14.25

Event History

Nov 12, 2026

CVE Published

via MITRE·02:15 PM

Data Sourced

via MITRE·02:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·06:47 PM

DescriptionAffected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

An attacker must have already compromised a PostgreSQL server and be able to influence backup manifest bytes processed by pg_basebackup. This is not described as an initial server-compromise vector.

What could an attacker obtain through successful exploitation?

The issue can cause disclosure of data from pg_basebackup memory. The improperly read bytes are not sent back to the attacker’s server, so obtaining useful secrets additionally requires implementation-specific means to recover them.

Which PostgreSQL releases need to be updated?

Affected releases are those before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Update to the applicable listed release or later.

Is integrity impact expected?

Integrity impact is unlikely. The applicable formatter does not support the %n format specifier.

CVE-2026-16240: PostgreSQL pg_basebackup can use backup manifest content as a format string

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What could an attacker obtain through successful exploitation?

Which PostgreSQL releases need to be updated?

Is integrity impact expected?

Company

Resources

Contact