CVE-2026-116323

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116323", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-10-26T03:52:44.053Z", "datePublished": "2026-11-12T14:15:13.913Z", "dateUpdated": "2026-11-12T14:15:13.913Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-11-12T14:15:13.913Z"}, "title": "PostgreSQL pltcl reentrant result conversion use-after-free executes arbitrary code", "x_postgresql": {"component": "core server"}, "descriptions": [{"lang": "en", "value": "Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}], "affected": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.7", "status": "affected", "version": "18", "versionType": "rpm"}, {"lessThan": "17.12", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.16", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.20", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.25", "status": "affected", "version": "0", "versionType": "rpm"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-416", "type": "CWE", "description": "Use After Free"}]}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2026-116323/"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "configurations": [{"lang": "en", "value": "Attacker has permission to \"CREATE EXTENSION pltcl\", or another user previously issued that. Attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)."}], "credits": [{"lang": "en", "value": "The PostgreSQL project thanks Anthropic OSS program for reporting this problem."}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.7", "status": "affected", "version": "18", "versionType": "rpm"}, {"lessThan": "17.12", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.16", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.20", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.25", "status": "affected", "version": "0", "versionType": "rpm"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}], "id": "CVE-2026-116323", "lastModified": "2026-11-12T19:02:35.830", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}, "published": "2026-11-12T15:17:40.823", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://www.postgresql.org/support/security/CVE-2026-116323/"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "postgresql: postgresql: Arbitrary code execution via use-after-free in PL/Tcl", "id": "2572529", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572529"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in PostgreSQL. A use-after-free vulnerability in the PL/Tcl procedural language extension occurs when evaluating domain CHECK constraints that re-enter the Tcl interpreter. An authenticated database user with privileges to create objects can exploit this flaw to execute arbitrary code as the operating system user running the database service."], "mitigation": {"lang": "en:us", "value": "If PL/Tcl is not required, remove the optional procedural language package or drop the extension from affected databases. Alternatively, restrict object creation permissions for untrusted database accounts.\n1. To remove the optional PL/Tcl package:\n# dnf remove postgresql-pltcl\n2. To remove the extension from a specific database, execute the following SQL commands as a database administrator:\nDROP EXTENSION IF EXISTS pltcl CASCADE;\nDROP EXTENSION IF EXISTS pltclu CASCADE;\n3. To prevent untrusted accounts from creating custom domains or objects, revoke schema creation privileges:\nREVOKE CREATE ON SCHEMA <schema_name> FROM <username>;\nCaveats:\nDropping the extension with CASCADE removes all dependent database functions, triggers, and objects implemented in PL/Tcl, which can impair application functionality. If package removal or administrative actions require reloading or restarting the PostgreSQL service (systemctl restart postgresql), active client connections will be terminated."}, "name": "CVE-2026-116323", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "libpq", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "postgresql17", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "postgresql18", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-12T14:15:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116323\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116323\nhttps://www.postgresql.org/support/security/CVE-2026-116323/"], "statement": "Red Hat rates this vulnerability as Important because an authenticated user with permission to create database objects can achieve arbitrary code execution under the postgres operating system account. In standard Red Hat Enterprise Linux deployments, the PL/Tcl procedural language is neither installed nor enabled by default, significantly limiting exposure on typical systems. Risk is primarily confined to environments where the optional PL/Tcl subpackage is explicitly installed and untrusted users have been granted object creation privileges.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18,18.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[17,17.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[16,16.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15,15.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,14.25)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PostgreSQL", "source": "cna", "vendor": "n/a"}, "product": "postgresql", "vendor": "postgresql"}], "created": "2026-11-12T23:45:10.756023+00:00", "updated": "2026-11-13T05:45:15.830293+00:00", "vendors": ["postgresql", "postgresql$PRODUCT$postgresql"]}