External Control Format String Vulnerability in PostgreSQL pg_basebackup

CVE-2026-16240

What is CVE-2026-16240?

The vulnerability in PostgreSQL’s pg_basebackup allows an attacker who has already compromised a server to exploit the use of an externally-controlled format string. This can lead to an information disclosure from the memory of pg_basebackup through exposure of backup manifest bytes. Although the attacker does not receive the improperly-read bytes directly, the vulnerability opens the door for potential further exploitation if additional implementation-specific secrets are utilized. Integrity of the data is unlikely to be compromised, as the applicable formatter does not support the %n format, which prevents certain types of attacks. To mitigate this risk, users are advised to upgrade to PostgreSQL versions 18.7, 17.12, 16.16, 15.20, or 14.25.

References