UBUNTU-CVE-2026-120149: Buffer Overflow
Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied. postgresfdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Which PostgreSQL deployments are exposed?
Exposure requires use of postgres_fdw with foreign batch inserts. A foreign server involved in those inserts can trigger the issue by reporting more inserted rows than were supplied.
What level of access does an attacker need?
The severity vector indicates low privileges are required and no user interaction is needed. The attack depends on a foreign server being able to provide the affected row-count response.
How can I determine whether an installed version is affected?
Versions earlier than PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The listed Ubuntu packages include postgresql-14, postgresql-16, postgresql-18, and older PostgreSQL package lines.