Use-After-Free Vulnerability in pglogical by EnterpriseDB

CVE-2026-50738

What is CVE-2026-50738?

A use-after-free condition in pglogical's worker signaling code can allow a worker structure to be erroneously dereferenced after its underlying slot has been freed. This vulnerability is particularly dangerous during normal replication operations and can be exploited by low-privileged users who manipulate worker management timings. Such exploitation could lead to worker crashes, impacting system availability or, in severe scenarios, facilitate remote code execution within the PostgreSQL backend, operating with the privileges of that backend.

References