{"id":"CVE-2026-116315","kind":"vulnerability","aliases":["CVE-2026-116315"],"related":[],"title":"PostgreSQL: tsvector_delete heap overflow lets a database user run code","description":"Heap-based buffer overflow in PostgreSQL tsvector_delete() allows a database user to execute arbitrary code as the operating system user running the database, via a tsvector whose lexeme data uses a nonstandard but valid ordering that requires additional alignment padding in the result.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"A heap-based buffer overflow in PostgreSQL's tsvector_delete() function can be triggered by a crafted tsvector value with a nonstandard but valid lexeme ordering. A database user with ordinary access can use it to execute arbitrary code as the operating system user running the database.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["managed-hosting-patched","no-untrusted-db-users"],"how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions listed below.\n- Check the server major version with `postgres --version`.","fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","status":"open","published_at":"2026-11-12T15:17:39+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","triaged_at":"2026-11-12T15:43:35+00:00","updated_at":"2026-11-12T15:43:35+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-12T15:43:35Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","reach":"network","title":"PostgreSQL: tsvector_delete heap overflow lets a database user run code","impact":"high","summary":"A heap-based buffer overflow in PostgreSQL's tsvector_delete() function can be triggered by a crafted tsvector value with a nonstandard but valid lexeme ordering. A database user with ordinary access can use it to execute arbitrary code as the operating system user running the database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Database user runs code as the PostgreSQL operating system account.","analyst_note":"","how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions listed below.\n- Check the server major version with `postgres --version`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting-patched","no-untrusted-db-users"],"who_is_affected":"Any PostgreSQL server on a version before 18.7, 17.12, 16.16, 15.20 or 14.25 is affected. The attacker needs a normal database login, so exposure depends on who holds database accounts and whether untrusted users can run queries that call tsvector functions. unknown whether managed hosting providers have already patched.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00075,"input_tokens":4593,"output_tokens":581,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116315':14A,17A '-2026':13A,16A '14.25':125C '15.20':123C '16.16':122C '17.12':121C '18.7':120C 'access':56B 'addit':111C 'affect':127C 'align':112C 'allow':81C 'arbitrari':62B,87C 'base':27B,74C 'buffer':28B,75C 'code':11A,63B,88C 'craft':41B 'cve':12A,15A 'data':102C 'databas':8A,18B,52B,71B,83C,96C 'delet':3A,34B,80C 'execut':61B,86C 'function':35B 'heap':4A,26B,73C 'heap-bas':25B,72C 'host':23B 'let':6A 'lexem':49B,101C 'nonstandard':46B,105C 'oper':66B,91C 'order':50B,108C 'ordinari':55B 'overflow':5A,29B,76C 'pad':113C 'postgresql':1A,19B,31B,78C,119C 'requir':110C 'result':116C 'run':10A,69B,94C 'runtim':20B 'self':22B 'self-host':21B 'system':67B,92C 'trigger':38B 'tsvector':2A,33B,42B,79C,99C 'use':58B,103C 'user':9A,53B,68B,84C,93C 'valid':48B,107C 'valu':43B 'version':117C 'via':97C 'whose':100C","nicknames":[],"mitigations":[],"who_affected":"Any PostgreSQL server on a version before 18.7, 17.12, 16.16, 15.20 or 14.25 is affected. The attacker needs a normal database login, so exposure depends on who holds database accounts and whether untrusted users can run queries that call tsvector functions. unknown whether managed hosting providers have already patched.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116315':14A,17A '-2026':13A,16A 'code':11A 'cve':12A,15A 'databas':8A 'delet':3A 'heap':4A 'let':6A 'overflow':5A 'postgresql':1A 'run':10A 'tsvector':2A 'user':9A","search_b":"'access':56B 'arbitrari':62B 'base':27B 'buffer':28B 'code':63B 'craft':41B 'databas':18B,52B,71B 'delet':34B 'execut':61B 'function':35B 'heap':26B 'heap-bas':25B 'host':23B 'lexem':49B 'nonstandard':46B 'oper':66B 'order':50B 'ordinari':55B 'overflow':29B 'postgresql':19B,31B 'run':69B 'runtim':20B 'self':22B 'self-host':21B 'system':67B 'trigger':38B 'tsvector':33B,42B 'use':58B 'user':53B,68B 'valid':48B 'valu':43B","search_c":"'14.25':125C '15.20':123C '16.16':122C '17.12':121C '18.7':120C 'addit':111C 'affect':127C 'align':112C 'allow':81C 'arbitrari':87C 'base':74C 'buffer':75C 'code':88C 'data':102C 'databas':83C,96C 'delet':80C 'execut':86C 'heap':73C 'heap-bas':72C 'lexem':101C 'nonstandard':105C 'oper':91C 'order':108C 'overflow':76C 'pad':113C 'postgresql':78C,119C 'requir':110C 'result':116C 'run':94C 'system':92C 'tsvector':79C,99C 'use':103C 'user':84C,93C 'valid':107C 'version':117C 'via':97C 'whose':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116315","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116315","severity":null,"published_at":"2026-11-12T15:17:39+00:00","modified_at":"2026-11-12T15:17:39+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","fetched_at":"2026-11-12T15:41:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}