{"id":"CVE-2026-116328","kind":"vulnerability","aliases":["CVE-2026-116328"],"related":[],"title":"PostgreSQL: integer wraparound lets a database user run OS code","description":"Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position.  Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected.  Versions before PostgreSQL 16 are unaffected.","summary":"PostgreSQL's generation memory contexts have an integer wraparound bug triggered by freeing an allocation over 1 GB. A database user can use it to execute arbitrary code as the operating system user running the database.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["managed-hosting-patched","postgresql-15-or-older"],"how_to_check":"- Run `SELECT version();` in psql and compare the version against the affected ranges\n- Check the installed server version with `postgres --version`\n- Affected: major versions 16 to 18 before `18.7`, `17.12`, and `16.16`","fix":"- Upgrade PostgreSQL 18 to `18.7` or later\n- Upgrade PostgreSQL 17 to `17.12` or later\n- Upgrade PostgreSQL 16 to `16.16` or later\n- Versions before PostgreSQL 16 are unaffected","status":"open","published_at":"2026-11-12T15:17:41+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","triaged_at":"2026-11-12T15:43:25+00:00","updated_at":"2026-11-12T15:43:25+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:25Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PostgreSQL 18 to `18.7` or later\n- Upgrade PostgreSQL 17 to `17.12` or later\n- Upgrade PostgreSQL 16 to `16.16` or later\n- Versions before PostgreSQL 16 are unaffected","reach":"network","title":"PostgreSQL: integer wraparound lets a database user run OS code","impact":"high","summary":"PostgreSQL's generation memory contexts have an integer wraparound bug triggered by freeing an allocation over 1 GB. A database user can use it to execute arbitrary code as the operating system user running the database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs arbitrary code as the database operating system user","analyst_note":"","how_to_check":"- Run `SELECT version();` in psql and compare the version against the affected ranges\n- Check the installed server version with `postgres --version`\n- Affected: major versions 16 to 18 before `18.7`, `17.12`, and `16.16`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["postgresql-15-or-older","managed-hosting-patched"],"who_is_affected":"Any server running PostgreSQL 16, 17, or 18 below the patched minor versions is exposed, and the attacker must already hold a database login. Servers running PostgreSQL 15 or earlier are not affected, per the sources. Teams using managed database services should wait for the provider to apply the patch.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000769,"input_tokens":4613,"output_tokens":616,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116328':13A,16A '-18':113C '-2026':12A,15A '1':39B,88C '16':112C,127C '16.16':121C '17.12':119C '18.7':118C 'affect':123C 'alloc':37B,85C 'allow':66C 'arbitrari':49B,72C 'back':102C 'back-point':101C 'block':93C 'bug':32B 'cannot':105C 'caus':91C 'chunk':99C 'code':10A,50B,73C 'context':27B,65C 'cve':11A,14A 'databas':6A,17B,42B,58B,68C,81C 'execut':48B,71C 'free':35B,83C 'gb':40B,89C 'generat':25B,63C 'host':22B 'integ':2A,30B,59C 'larger':86C 'let':4A 'major':110C 'memori':26B,64C 'minor':114C 'offset':104C 'oper':53B,76C 'os':9A 'pointer':103C 'posit':108C 'postgresql':1A,18B,23B,62C,117C,126C 'repres':106C 'reus':96C 'run':8A,56B,79C 'runtim':19B 'self':21B 'self-host':20B 'smaller':98C 'system':54B,77C 'trigger':33B 'unaffect':129C 'use':45B 'user':7A,43B,55B,69C,78C 'version':111C,115C,124C 'via':82C 'whose':100C 'within':109C 'wraparound':3A,31B,60C","nicknames":[],"mitigations":[],"who_affected":"Any server running PostgreSQL 16, 17, or 18 below the patched minor versions is exposed, and the attacker must already hold a database login. Servers running PostgreSQL 15 or earlier are not affected, per the sources. Teams using managed database services should wait for the provider to apply the patch.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116328':13A,16A '-2026':12A,15A 'code':10A 'cve':11A,14A 'databas':6A 'integ':2A 'let':4A 'os':9A 'postgresql':1A 'run':8A 'user':7A 'wraparound':3A","search_b":"'1':39B 'alloc':37B 'arbitrari':49B 'bug':32B 'code':50B 'context':27B 'databas':17B,42B,58B 'execut':48B 'free':35B 'gb':40B 'generat':25B 'host':22B 'integ':30B 'memori':26B 'oper':53B 'postgresql':18B,23B 'run':56B 'runtim':19B 'self':21B 'self-host':20B 'system':54B 'trigger':33B 'use':45B 'user':43B,55B 'wraparound':31B","search_c":"'-18':113C '1':88C '16':112C,127C '16.16':121C '17.12':119C '18.7':118C 'affect':123C 'alloc':85C 'allow':66C 'arbitrari':72C 'back':102C 'back-point':101C 'block':93C 'cannot':105C 'caus':91C 'chunk':99C 'code':73C 'context':65C 'databas':68C,81C 'execut':71C 'free':83C 'gb':89C 'generat':63C 'integ':59C 'larger':86C 'major':110C 'memori':64C 'minor':114C 'offset':104C 'oper':76C 'pointer':103C 'posit':108C 'postgresql':62C,117C,126C 'repres':106C 'reus':96C 'run':79C 'smaller':98C 'system':77C 'unaffect':129C 'user':69C,78C 'version':111C,115C,124C 'via':82C 'whose':100C 'within':109C 'wraparound':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116328","severity":null,"published_at":"2026-11-12T15:17:41+00:00","modified_at":"2026-11-12T15:17:41+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","fetched_at":"2026-11-12T15:41:55+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}