REDHAT-BUG-2515326: High severity PostgreSQL postgresql vulnerability

Q: Who can exploit this issue?

An attacker needs the ability to create an object in PostgreSQL and to supply a chosen non-ctid input to the ctid data type selectivity estimator. The issue can expose a calculation derived from an arbitrary 4-byte memory span.

Q: What is the impact of successful exploitation?

Successful exploitation may permit substantial recovery of memory values, although the exposed calculation loses precision. The disclosed data is derived from arbitrary 4-byte spans of memory rather than being returned directly.

Published Aug 13, 2026

Updated

Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Affected Software

1 affected component

PostgreSQL postgresql<18.5, <17.11, <16.15, <15.19, <14.24

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 18.5
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 17.11
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 16.15
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 15.19
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 14.24

Event History

Aug 13, 2026

Data Sourced

via Red Hat·01:30 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker needs the ability to create an object in PostgreSQL and to supply a chosen non-ctid input to the ctid data type selectivity estimator. The issue can expose a calculation derived from an arbitrary 4-byte memory span.

Which PostgreSQL releases need updates?

Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. Update to the applicable listed release or later.

What is the impact of successful exploitation?

Successful exploitation may permit substantial recovery of memory values, although the exposed calculation loses precision. The disclosed data is derived from arbitrary 4-byte spans of memory rather than being returned directly.

REDHAT-BUG-2515326: High severity PostgreSQL postgresql vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which PostgreSQL releases need updates?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which PostgreSQL releases need updates?

What is the impact of successful exploitation?