Improper Null Termination in PostgreSQL Allows Memory Disclosure

CVE-2026-116321

What is CVE-2026-116321?

An improper null termination vulnerability exists in PostgreSQL array element assignment, which allows a database user to inadvertently disclose server memory. This occurs when the final byte of a fixed-length name value is manipulated to become a nonzero byte. When this altered value is processed by code that interprets it as a C string, sensitive information stored in memory may be revealed, potentially leading to unauthorized access or exploitation. Users of PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25 should take immediate action to mitigate risks associated with this vulnerability.

References