CVE-2026-16238

EUVD-2026-57848
Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values.  Within major version 18, minor versions before PostgreSQL 18.6 are affected.  Versions before PostgreSQL 18 are unaffected.
Type Confusion
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 33.19%
Affected Products (NVD)
VendorProductVersion
postgresqlpostgresql
14.0 ≤
𝑥
< 14.24
postgresqlpostgresql
15.0 ≤
𝑥
< 15.19
postgresqlpostgresql
16.0 ≤
𝑥
< 16.15
postgresqlpostgresql
17.0 ≤
𝑥
< 17.11
postgresqlpostgresql
18.0 ≤
𝑥
< 18.5
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
postgresql-15
bookworm
15.18-0+deb12u1
fixed
bookworm (security)
15.19-0+deb12u1
fixed
postgresql-17
trixie
17.11-0+deb13u1
fixed
trixie (security)
17.11-0+deb13u1
fixed
postgresql-18
forky
18.6-3
fixed
sid
18.6-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
postgresql-18
jammy
dne
noble
dne
resolute
Fixed 18.6-0ubuntu0.26.04.1
released
postgresql-16
jammy
dne
noble
not-affected
resolute
dne
postgresql-14
jammy
not-affected
noble
dne
resolute
dne
postgresql-12
focal
not-affected
jammy
dne
noble
dne
resolute
dne
postgresql-10
bionic
not-affected
jammy
dne
noble
dne
resolute
dne
postgresql-9.5
jammy
dne
noble
dne
resolute
dne
xenial
not-affected
postgresql-9.3
jammy
dne
noble
dne
resolute
dne
trusty
deferred
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libecpg6
suse enterprise sap 12 SP5
18.6-8.17.1
fixed
suse enterprise sap 15 SP4
18.6-150200.5.17.1
fixed
suse enterprise sap 15 SP5
18.6-150200.5.17.1
fixed
suse enterprise sap 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise sap 15 SP7
18.6-150600.13.16.1
fixed
suse enterprise server 12 SP5
18.6-8.17.1
fixed
suse enterprise server 15 SP4
18.6-150200.5.17.1
fixed
suse enterprise server 15 SP5
18.6-150200.5.17.1
fixed
suse enterprise server 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP7
18.6-150600.13.16.1
fixed
libecpg6-32bit
suse enterprise sap 12 SP5
18.6-8.17.1
fixed
suse enterprise server 12 SP5
18.6-8.17.1
fixed
libpq5
suse enterprise desktop 15 SP7
18.6-150600.13.16.1
fixed
suse enterprise sap 12 SP5
18.6-8.17.1
fixed
suse enterprise sap 15 SP4
18.6-150200.5.17.1
fixed
suse enterprise sap 15 SP5
18.6-150200.5.17.1
fixed
suse enterprise sap 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise sap 15 SP7
18.6-150600.13.16.1
fixed
suse enterprise server 12 SP5
18.6-8.17.1
fixed
suse enterprise server 15 SP4
18.6-150200.5.17.1
fixed
suse enterprise server 15 SP5
18.6-150200.5.17.1
fixed
suse enterprise server 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP7
18.6-150600.13.16.1
fixed
libpq5-32bit
suse enterprise desktop 15 SP7
18.6-150600.13.16.1
fixed
suse enterprise sap 12 SP5
18.6-8.17.1
fixed
suse enterprise sap 15 SP4
18.6-150200.5.17.1
fixed
suse enterprise sap 15 SP5
18.6-150200.5.17.1
fixed
suse enterprise sap 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise sap 15 SP7
18.6-150600.13.16.1
fixed
suse enterprise server 12 SP5
18.6-8.17.1
fixed
suse enterprise server 15 SP4
18.6-150200.5.17.1
fixed
suse enterprise server 15 SP5
18.6-150200.5.17.1
fixed
suse enterprise server 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP7
18.6-150600.13.16.1
fixed
postgresql18
suse enterprise desktop 15 SP7
18.6-150600.13.16.1
fixed
suse enterprise sap 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise sap 15 SP7
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP7
18.6-150600.13.16.1
fixed
postgresql18-contrib
suse enterprise sap 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise sap 15 SP7
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP7
18.6-150600.13.16.1
fixed
postgresql18-devel
suse enterprise sap 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise sap 15 SP7
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP7
18.6-150600.13.16.1
fixed
postgresql18-docs
suse enterprise sap 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise sap 15 SP7
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP7
18.6-150600.13.16.1
fixed
postgresql18-plperl
suse enterprise sap 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise sap 15 SP7
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP7
18.6-150600.13.16.1
fixed
postgresql18-plpython
suse enterprise sap 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise sap 15 SP7
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP7
18.6-150600.13.16.1
fixed
postgresql18-pltcl
suse enterprise sap 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise sap 15 SP7
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP7
18.6-150600.13.16.1
fixed
postgresql18-server
suse enterprise sap 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise sap 15 SP7
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP7
18.6-150600.13.16.1
fixed
postgresql18-server-devel
suse enterprise sap 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise sap 15 SP7
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP6
18.6-150600.13.16.1
fixed
suse enterprise server 15 SP7
18.6-150600.13.16.1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
postgresql18
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-contrib
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-contrib-debuginfo
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-debuginfo
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-debugsource
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-docs
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-docs-debuginfo
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-llvmjit
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-llvmjit-debuginfo
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-plperl
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-plperl-debuginfo
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-plpython3
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-plpython3-debuginfo
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-pltcl
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-pltcl-debuginfo
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-private-devel
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-private-libs
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-private-libs-debuginfo
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-server
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-server-debuginfo
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-server-devel
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-server-devel-debuginfo
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-static
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-test
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-test-debuginfo
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-test-rpm-macros
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-upgrade
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-upgrade-debuginfo
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-upgrade-devel
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
postgresql18-upgrade-devel-debuginfo
Amazon Linux 2023
0:18.6-1.amzn2023.0.1
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://www.postgresql.org/support/security/CVE-2026-16238/