CVE-2026-16238

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16238", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-07-20T01:55:07.055Z", "datePublished": "2026-08-13T13:00:12.450Z", "dateUpdated": "2026-08-29T23:07:28.490Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-08-29T23:07:28.490Z"}, "title": "PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code", "x_postgresql": {"component": "core server"}, "descriptions": [{"lang": "en", "value": "Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected."}], "affected": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.6", "status": "affected", "version": "18", "versionType": "rpm"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-843", "type": "CWE", "description": "Access of Resource Using Incompatible Type ('Type Confusion')"}]}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2026-16238/"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "configurations": [{"lang": "en", "value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"}], "workarounds": [{"lang": "en", "value": "Revoke public EXECUTE permission on the function"}], "credits": [{"lang": "en", "value": "The PostgreSQL project thanks Amy Burnett (OpenAI Codex Security) for reporting this problem."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-16238"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T03:55:36.042Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-16238", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-13T14:30:30.648909Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T15:38:10.884Z"}}], "cna": {"title": "PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code", "credits": [{"lang": "en", "value": "The PostgreSQL project thanks Amy Burnett (OpenAI Codex Security) for reporting this problem."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "n/a", "product": "PostgreSQL", "versions": [{"status": "affected", "version": "18", "lessThan": "18.6", "versionType": "rpm"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2026-16238/"}], "workarounds": [{"lang": "en", "value": "Revoke public EXECUTE permission on the function"}], "descriptions": [{"lang": "en", "value": "Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-843", "description": "Access of Resource Using Incompatible Type ('Type Confusion')"}]}], "x_postgresql": {"component": "core server"}, "configurations": [{"lang": "en", "value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-08-29T23:07:28.490Z"}}}, "cveMetadata": {"cveId": "CVE-2026-16238", "state": "PUBLISHED", "dateUpdated": "2026-08-29T23:07:28.490Z", "dateReserved": "2026-07-20T01:55:07.055Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2026-08-13T13:00:12.450Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.6", "status": "affected", "version": "18", "versionType": "rpm"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "6BEE5714-C2EF-48DC-8613-C3EAA149E12E", "versionEndExcluding": "14.24", "versionStartIncluding": "14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "F433746A-733F-4ED0-9913-8AF69E0C8BF2", "versionEndExcluding": "15.19", "versionStartIncluding": "15.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "1996B91F-E0B2-4A78-8788-E17EA68D179C", "versionEndExcluding": "16.15", "versionStartIncluding": "16.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "3D04E642-71D7-4979-AA19-B9CCDEFD8C31", "versionEndExcluding": "17.11", "versionStartIncluding": "17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "8494F67B-673A-4E1F-8F40-D24DCC1F8DA4", "versionEndExcluding": "18.5", "versionStartIncluding": "18.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected."}], "id": "CVE-2026-16238", "lastModified": "2026-08-29T23:17:19.083", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16238", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-08-13T13:17:46.383", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "tags": ["Vendor Advisory"], "url": "https://www.postgresql.org/support/security/CVE-2026-16238/"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-843"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18,18.5)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PostgreSQL", "source": "cna", "vendor": "n/a"}, "product": "postgresql", "vendor": "postgresql"}], "created": "2026-08-13T14:45:03.080741+00:00", "updated": "2026-08-30T01:15:05.285248+00:00", "vendors": ["postgresql", "postgresql$PRODUCT$postgresql"]}