{"id":"CVE-2026-116304","kind":"vulnerability","aliases":["CVE-2026-116304"],"related":[],"title":"PostgreSQL: parallel workers' record type handling lets a database user run code","description":"Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbitrary code as the operating system user running the database, via causing one process to free a shared tuple descriptor while another process retains and later uses its address.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"A use-after-free flaw in how PostgreSQL parallel workers share anonymous RECORD type descriptors lets one process free memory another still uses. A database user with login rights can run arbitrary code as the operating system user running the database.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["managed-hosting","no-untrusted-db-users"],"how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions below.\n- Check the installed server binary with `postgres --version`.","fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","status":"open","published_at":"2026-11-12T15:17:38+00:00","first_seen_at":"2026-11-12T15:41:53+00:00","triaged_at":"2026-11-12T15:43:41+00:00","updated_at":"2026-11-12T15:43:41+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-12T15:43:41Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","reach":"network","title":"PostgreSQL: parallel workers' record type handling lets a database user run code","impact":"high","summary":"A use-after-free flaw in how PostgreSQL parallel workers share anonymous RECORD type descriptors lets one process free memory another still uses. A database user with login rights can run arbitrary code as the operating system user running the database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Database user runs code as the PostgreSQL operating system user","analyst_note":"","how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions below.\n- Check the installed server binary with `postgres --version`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting","no-untrusted-db-users"],"who_is_affected":"Any PostgreSQL server before the fixed versions is affected. The attacker needs a database login, and the flaw is reached through queries that use parallel workers, so servers where users have no database access are much less exposed. Teams running managed PostgreSQL should check with their provider.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":4584,"output_tokens":536,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116304':15A,18A '-2026':14A,17A '14.25':124C '15.20':122C '16.16':121C '17.12':120C '18.7':119C 'address':115C 'affect':126C 'allow':81C 'among':78C 'anonym':37B,74C 'anoth':46B,108C 'arbitrari':57B,87C 'caus':98C 'code':12A,58B,88C 'coordin':72C 'cve':13A,16A 'databas':9A,19B,50B,66B,83C,96C 'descriptor':40B,106C 'execut':86C 'flaw':30B 'free':29B,44B,69C,102C 'handl':6A 'host':24B 'identifi':77C 'later':112C 'let':7A,41B 'login':53B 'memori':45B 'one':42B,99C 'oper':61B,91C 'parallel':2A,34B,79C 'postgresql':1A,20B,33B,71C,118C 'process':43B,100C,109C 'record':4A,38B,75C 'retain':110C 'right':54B 'run':11A,56B,64B,94C 'runtim':21B 'self':23B 'self-host':22B 'share':36B,104C 'still':47B 'system':62B,92C 'tupl':105C 'type':5A,39B,76C 'use':27B,48B,67C,113C 'use-after-fre':26B 'user':10A,51B,63B,84C,93C 'version':116C 'via':97C 'worker':3A,35B,80C","nicknames":[],"mitigations":[],"who_affected":"Any PostgreSQL server before the fixed versions is affected. The attacker needs a database login, and the flaw is reached through queries that use parallel workers, so servers where users have no database access are much less exposed. Teams running managed PostgreSQL should check with their provider.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116304':15A,18A '-2026':14A,17A 'code':12A 'cve':13A,16A 'databas':9A 'handl':6A 'let':7A 'parallel':2A 'postgresql':1A 'record':4A 'run':11A 'type':5A 'user':10A 'worker':3A","search_b":"'anonym':37B 'anoth':46B 'arbitrari':57B 'code':58B 'databas':19B,50B,66B 'descriptor':40B 'flaw':30B 'free':29B,44B 'host':24B 'let':41B 'login':53B 'memori':45B 'one':42B 'oper':61B 'parallel':34B 'postgresql':20B,33B 'process':43B 'record':38B 'right':54B 'run':56B,64B 'runtim':21B 'self':23B 'self-host':22B 'share':36B 'still':47B 'system':62B 'type':39B 'use':27B,48B 'use-after-fre':26B 'user':51B,63B 'worker':35B","search_c":"'14.25':124C '15.20':122C '16.16':121C '17.12':120C '18.7':119C 'address':115C 'affect':126C 'allow':81C 'among':78C 'anonym':74C 'anoth':108C 'arbitrari':87C 'caus':98C 'code':88C 'coordin':72C 'databas':83C,96C 'descriptor':106C 'execut':86C 'free':69C,102C 'identifi':77C 'later':112C 'one':99C 'oper':91C 'parallel':79C 'postgresql':71C,118C 'process':100C,109C 'record':75C 'retain':110C 'run':94C 'share':104C 'system':92C 'tupl':105C 'type':76C 'use':67C,113C 'user':84C,93C 'version':116C 'via':97C 'worker':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116304","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116304","severity":null,"published_at":"2026-11-12T15:17:38+00:00","modified_at":"2026-11-12T15:17:38+00:00","first_seen_at":"2026-11-12T15:41:53+00:00","fetched_at":"2026-11-12T15:41:53+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}