{"id":"CVE-2026-116323","kind":"vulnerability","aliases":["CVE-2026-116323"],"related":[],"title":"PostgreSQL: pltcl use-after-free lets object creators run OS code","description":"Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"PostgreSQL's pltcl procedural language has a use-after-free bug triggered when a domain CHECK constraint re-enters the Tcl interpreter. A user who can create database objects can use it to execute arbitrary code as the operating system user running the database.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PostgreSQL","fixed":[],"affected":"","ecosystem":"runtime"}],"ecosystems":["runtime"],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["no-untrusted-object-creators","pltcl-not-installed"],"how_to_check":"- Run `psql -c \"SHOW server_version;\"` and compare against the fixed versions below.\n- Check whether the pltcl extension is installed: `psql -c \"SELECT * FROM pg_extension WHERE extname = 'pltcl';\"`.\n- Check whether the `pltcl` language is available: `psql -c \"SELECT lanname FROM pg_language WHERE lanname = 'pltcl';\"`.","fix":"- PostgreSQL `18.7`, `17.12`, `16.16`, `15.20`, and `14.25` contain the fix; earlier versions in each line are affected.","status":"open","published_at":"2026-11-12T15:17:40+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","triaged_at":"2026-11-12T15:43:29+00:00","updated_at":"2026-11-12T15:43:29+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:29Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`, `17.12`, `16.16`, `15.20`, and `14.25` contain the fix; earlier versions in each line are affected.","reach":"network","title":"PostgreSQL: pltcl use-after-free lets object creators run OS code","impact":"high","summary":"PostgreSQL's pltcl procedural language has a use-after-free bug triggered when a domain CHECK constraint re-enters the Tcl interpreter. A user who can create database objects can use it to execute arbitrary code as the operating system user running the database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs arbitrary code as the PostgreSQL operating system user","analyst_note":"","how_to_check":"- Run `psql -c \"SHOW server_version;\"` and compare against the fixed versions below.\n- Check whether the pltcl extension is installed: `psql -c \"SELECT * FROM pg_extension WHERE extname = 'pltcl';\"`.\n- Check whether the `pltcl` language is available: `psql -c \"SELECT lanname FROM pg_language WHERE lanname = 'pltcl';\"`.","plain_action":"","product_name":"PostgreSQL","needs_analyst":false,"not_affected_if":["pltcl-not-installed","no-untrusted-object-creators"],"who_is_affected":"Only PostgreSQL servers with the pltcl language installed are exposed, since the flaw is in its Tcl interpreter integration. The attacker must be able to create objects such as domains with CHECK constraints, so databases where only trusted administrators can create objects carry lower risk. Servers without pltcl can skip it.","user_interaction":"no","product_ecosystem":"runtime","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000798,"input_tokens":4577,"output_tokens":681,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116323':15A,18A '-2026':14A,17A '14.25':126C '15.20':124C '16.16':123C '17.12':122C '18.7':121C 'affect':128C 'allow':78C 'arbitrari':62B,84C 'bug':37B 'chang':108C 'check':42B,97C 'code':12A,63B,85C 'constraint':43B 'convers':117C 'creat':54B 'creator':9A,81C 'cve':13A,16A 'databas':20B,55B,71B,93C 'domain':41B,96C 'enter':46B,101C 'execut':61B,83C 'free':6A,36B,74C,106C 'host':25B 'interpret':49B,104C 'languag':30B 'let':7A 'object':8A,56B,80C 'oper':66B,88C 'os':11A 'outer':115C 'pltcl':2A,28B,77C 'postgresql':1A,19A,21B,26B,76C,120C 'procedur':29B 're':45B,100C 're-ent':44B,99C 'result':116C 'run':10A,69B,91C 'runtim':22B 'self':24B 'self-host':23B 'still':111C 'string':110C 'system':67B,89C 'tcl':48B,103C 'trigger':38B 'use':4A,34B,58B,72C,112C 'use-after-fre':3A,33B 'user':51B,68B,90C 'version':118C 'via':94C","nicknames":[],"mitigations":[],"who_affected":"Only PostgreSQL servers with the pltcl language installed are exposed, since the flaw is in its Tcl interpreter integration. The attacker must be able to create objects such as domains with CHECK constraints, so databases where only trusted administrators can create objects carry lower risk. Servers without pltcl can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["postgresql"],"ptokens":["postgresql"],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116323':15A,18A '-2026':14A,17A 'code':12A 'creator':9A 'cve':13A,16A 'free':6A 'let':7A 'object':8A 'os':11A 'pltcl':2A 'postgresql':1A,19A 'run':10A 'use':4A 'use-after-fre':3A","search_b":"'arbitrari':62B 'bug':37B 'check':42B 'code':63B 'constraint':43B 'creat':54B 'databas':20B,55B,71B 'domain':41B 'enter':46B 'execut':61B 'free':36B 'host':25B 'interpret':49B 'languag':30B 'object':56B 'oper':66B 'pltcl':28B 'postgresql':21B,26B 'procedur':29B 're':45B 're-ent':44B 'run':69B 'runtim':22B 'self':24B 'self-host':23B 'system':67B 'tcl':48B 'trigger':38B 'use':34B,58B 'use-after-fre':33B 'user':51B,68B","search_c":"'14.25':126C '15.20':124C '16.16':123C '17.12':122C '18.7':121C 'affect':128C 'allow':78C 'arbitrari':84C 'chang':108C 'check':97C 'code':85C 'convers':117C 'creator':81C 'databas':93C 'domain':96C 'enter':101C 'execut':83C 'free':74C,106C 'interpret':104C 'object':80C 'oper':88C 'outer':115C 'pltcl':77C 'postgresql':76C,120C 're':100C 're-ent':99C 'result':116C 'run':91C 'still':111C 'string':110C 'system':89C 'tcl':103C 'use':72C,112C 'user':90C 'version':118C 'via':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116323","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116323","severity":null,"published_at":"2026-11-12T15:17:40+00:00","modified_at":"2026-11-12T15:17:40+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","fetched_at":"2026-11-12T15:41:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}