Type Confusion Vulnerability in PostgreSQL by PostgreSQL Global Development Group
CVE-2026-116329

8.8HIGH

Key Information:

Vendor

PostgreSQL Global Development Group

Status
Postgresql
Vendor
CVE Published:
12 November 2026

What is CVE-2026-116329?

A type confusion vulnerability exists in the PostgreSQL statistics import feature, which enables a table maintainer to execute arbitrary code under the permissions of the operating system user that runs the database. This occurs through a nested SET DATA TYPE error during value conversion, allowing potential exploitation. The affected versions include PostgreSQL 18.0 through 18.6, while versions prior to 18.0 remain unaffected. Mitigation is crucial for database administrators to prevent unauthorized access and maintain system integrity.

Affected Version(s)

PostgreSQL 18 < 18.7

References

https://www.postgresql.org/support/security/CVE-2026-116329/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL project thanks Mehmet D. INCE for reporting this problem.
.