UBUNTU-CVE-2026-120152: Use After Free

Published Nov 13, 2026

Updated

Use after free in PostgreSQL pgshowallsettings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.

Affected Software

8 affected components

ubuntu/postgresql-9.3*

ubuntu/postgresql-9.5*

ubuntu/postgresql-10*

ubuntu/postgresql-12*

ubuntu/postgresql-14*

ubuntu/postgresql-16*

ubuntu/postgresql-18*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 18.7
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 17.12
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 16.16

Event History

Nov 13, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are affected?

PostgreSQL major versions 16 through 18 are affected when running versions earlier than 16.16, 17.12, or 18.7. PostgreSQL versions before 16 are unaffected.

What access does an attacker need?

An attacker needs database-user privileges. Exploitation involves loading a module while pg_show_all_settings() is scanning custom-variable placeholders that the module replaces and frees.

What is the impact of successful exploitation?

A database user may retrieve memory contents from the PostgreSQL process. The provided severity vector indicates low confidentiality impact and no integrity or availability impact.