{"id":"CVE-2026-116317","kind":"vulnerability","aliases":["CVE-2026-116317"],"related":[],"title":"PostgreSQL: ts_rank_cd() overflow lets a database user run code","description":"Heap-based buffer overflow in PostgreSQL ts_rank_cd() may allow a database user to execute arbitrary code as the operating system user running the database, via an invalid tsvector containing duplicate positions.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"A heap-based buffer overflow in PostgreSQL's ts_rank_cd() function can be triggered by an invalid tsvector containing duplicate positions. A database user who can run queries may execute arbitrary code as the operating system user that runs the database.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["no-untrusted-db-users","patched-version"],"how_to_check":"- Check the server version with `SELECT version();` and compare it to the fixed versions below.\n- Confirm whether untrusted users can run SQL against the database.","fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","status":"open","published_at":"2026-11-12T15:17:39+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","triaged_at":"2026-11-12T15:43:34+00:00","updated_at":"2026-11-12T15:43:34+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-12T15:43:34Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","reach":"local","title":"PostgreSQL: ts_rank_cd() overflow lets a database user run code","impact":"high","summary":"A heap-based buffer overflow in PostgreSQL's ts_rank_cd() function can be triggered by an invalid tsvector containing duplicate positions. A database user who can run queries may execute arbitrary code as the operating system user that runs the database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Database user runs arbitrary code as the PostgreSQL operating system user","analyst_note":"","how_to_check":"- Check the server version with `SELECT version();` and compare it to the fixed versions below.\n- Confirm whether untrusted users can run SQL against the database.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","no-untrusted-db-users"],"who_is_affected":"Any PostgreSQL server running a version before 18.7, 17.12, 16.16, 15.20 or 14.25 is affected. The attacker needs a database login, so exposure depends on who can run SQL on the server, including through application users with broad query rights. Servers where only trusted roles can connect are lower risk, but the fixed versions still close the flaw.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4574,"output_tokens":580,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116317':14A,17A '-2026':13A,16A '14.25':109C '15.20':107C '16.16':106C '17.12':105C '18.7':104C 'affect':111C 'allow':78C 'arbitrari':56B,84C 'base':27B,69C 'buffer':28B,70C 'cd':4A,35B,76C 'code':11A,57B,85C 'contain':44B,98C 'cve':12A,15A 'databas':8A,18B,48B,66B,80C,93C 'duplic':45B,99C 'execut':55B,83C 'function':36B 'heap':26B,68C 'heap-bas':25B,67C 'host':23B 'invalid':42B,96C 'let':6A 'may':54B,77C 'oper':60B,88C 'overflow':5A,29B,71C 'posit':46B,100C 'postgresql':1A,19B,31B,73C,103C 'queri':53B 'rank':3A,34B,75C 'run':10A,52B,64B,91C 'runtim':20B 'self':22B 'self-host':21B 'system':61B,89C 'trigger':39B 'ts':2A,33B,74C 'tsvector':43B,97C 'user':9A,49B,62B,81C,90C 'version':101C 'via':94C","nicknames":[],"mitigations":[],"who_affected":"Any PostgreSQL server running a version before 18.7, 17.12, 16.16, 15.20 or 14.25 is affected. The attacker needs a database login, so exposure depends on who can run SQL on the server, including through application users with broad query rights. Servers where only trusted roles can connect are lower risk, but the fixed versions still close the flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116317':14A,17A '-2026':13A,16A 'cd':4A 'code':11A 'cve':12A,15A 'databas':8A 'let':6A 'overflow':5A 'postgresql':1A 'rank':3A 'run':10A 'ts':2A 'user':9A","search_b":"'arbitrari':56B 'base':27B 'buffer':28B 'cd':35B 'code':57B 'contain':44B 'databas':18B,48B,66B 'duplic':45B 'execut':55B 'function':36B 'heap':26B 'heap-bas':25B 'host':23B 'invalid':42B 'may':54B 'oper':60B 'overflow':29B 'posit':46B 'postgresql':19B,31B 'queri':53B 'rank':34B 'run':52B,64B 'runtim':20B 'self':22B 'self-host':21B 'system':61B 'trigger':39B 'ts':33B 'tsvector':43B 'user':49B,62B","search_c":"'14.25':109C '15.20':107C '16.16':106C '17.12':105C '18.7':104C 'affect':111C 'allow':78C 'arbitrari':84C 'base':69C 'buffer':70C 'cd':76C 'code':85C 'contain':98C 'databas':80C,93C 'duplic':99C 'execut':83C 'heap':68C 'heap-bas':67C 'invalid':96C 'may':77C 'oper':88C 'overflow':71C 'posit':100C 'postgresql':73C,103C 'rank':75C 'run':91C 'system':89C 'ts':74C 'tsvector':97C 'user':81C,90C 'version':101C 'via':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116317","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116317","severity":null,"published_at":"2026-11-12T15:17:39+00:00","modified_at":"2026-11-12T15:17:39+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","fetched_at":"2026-11-12T15:41:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}