Type Confusion Vulnerability in PostgreSQL by PostgreSQL Global Development Group
CVE-2026-120142

8.8HIGH

Key Information:

Vendor

PostgreSQL Global Development Group

Status
Postgresql
Vendor
CVE Published:
12 November 2026

What is CVE-2026-120142?

A type confusion vulnerability exists in PostgreSQL affecting anonymous RECORD types. This flaw allows an attacker to execute arbitrary code as the operating system user of the database. This occurs when row types with dropped attributes have varying widths or alignments, enabling potential exploitation. Affected versions include PostgreSQL 17.0 through 17.12 and minor versions before 18.7, while versions prior to PostgreSQL 17 remain unaffected. Organizations using these versions should take immediate action to mitigate risks associated with this vulnerability.

Affected Version(s)

PostgreSQL 18 < 18.7

PostgreSQL 17 < 17.12

References

https://www.postgresql.org/support/security/CVE-2026-120142/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL project thanks Peter Geoghegan for reporting this problem.
.