UBUNTU-CVE-2026-18447: High severity ubuntu/postgresql-9.3 vulnerability
Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type "any". Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to create a database object. Exploitation can then execute arbitrary code as the operating system user that runs the PostgreSQL database.
Is unauthenticated remote exploitation possible?
No. The listed vector requires low privileges (PR:L), although it does not require user interaction and can be reached over the network (AV:N).
Which PostgreSQL releases are affected?
PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The Ubuntu software list includes PostgreSQL 18, 16, 14, 12, 10, 9.5, and 9.3 packages.