UBUNTU-CVE-2026-120150: Use After Free

Published Nov 13, 2026

Updated

Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause reuse of a dangling memory-context pointer. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Affected Software

8 affected components

ubuntu/postgresql-9.3*

ubuntu/postgresql-9.5*

ubuntu/postgresql-10*

ubuntu/postgresql-12*

ubuntu/postgresql-14*

ubuntu/postgresql-16*

ubuntu/postgresql-18*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 18.7
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 17.12
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 16.16
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 15.20
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 14.25

Event History

Nov 13, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker needs privileges to create an object in the database. Exploitation can result in arbitrary code execution as the operating system user that runs the PostgreSQL server.

Which PostgreSQL versions are affected?

PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The listed Ubuntu packages include postgresql-18, postgresql-16, postgresql-14, postgresql-12, postgresql-10, postgresql-9.5, and postgresql-9.3.

Is user interaction required for exploitation?

No. The vulnerability has no user-interaction requirement, and its attack vector is network-based with low attack complexity.