UBUNTU-CVE-2026-116304: Use After Free

Published Nov 13, 2026

Updated

Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbitrary code as the operating system user running the database, via causing one process to free a shared tuple descriptor while another process retains and later uses its address. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Affected Software

8 affected components

ubuntu/postgresql-9.3*

ubuntu/postgresql-9.5*

ubuntu/postgresql-10*

ubuntu/postgresql-12*

ubuntu/postgresql-14*

ubuntu/postgresql-16*

ubuntu/postgresql-18*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 18.7
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 17.12
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 16.16
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 15.20
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 14.25

Event History

Nov 13, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An authenticated database user with privileges to run the required SQL can exploit the flaw. The attack is network-reachable and does not require user interaction.

What is the impact if exploitation succeeds?

Successful exploitation can allow the database user to execute arbitrary code as the operating system account running PostgreSQL. This can compromise the confidentiality, integrity, and availability of resources accessible to that OS user.

Which PostgreSQL releases contain the fix?

The issue is fixed in PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Versions before those releases are affected.