CVE-2026-16238

PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code

At a glance

Severity: HIGH 8.8
EPSS: EPSS 0.41 % · percentile 36 (2026-10-27)
State: PUBLISHED
Published: 2026-08-13
Updated: 2026-08-29
Assigner: PostgreSQL
NVD status: Modified

Description

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	PostgreSQL
CVSS 3.1	HIGH 8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	NVD · f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 (Secondary)

Weaknesses (CWE)

CWE-843

European references

ENISA EUVD · EUVD-2026-57848
GCVE · GCVE-0-2026-16238

CERT-FR advisories

CERTFR-2026-AVI-1024 — Multiples vulnérabilités dans PostgreSQL · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 14.0 < 14.24
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 15.0 < 15.19
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 16.0 < 16.15
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 17.0 < 17.11
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 18.0 < 18.5

Affected products

Product	Versions
PostgreSQL	affected 18 < 18.6

References

https://www.postgresql.org/support/security/CVE-2026-16238/

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD