{"id":"CVE-2026-120139","kind":"vulnerability","aliases":["CVE-2026-120139"],"related":[],"title":"PostgreSQL: integer wraparound in tuple sizing lets a database user run code","description":"Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"PostgreSQL miscalculates in-memory tuple sizes because of an integer wraparound when handling oversized tuple data. A database user can use this to execute arbitrary code as the operating system user running the database.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["managed-hosting-patched","patched-version"],"how_to_check":"- Run `psql -c \"SHOW server_version;\"` and compare against the fixed versions below.\n- Check that the PostgreSQL server is at or above the fixed release for its major version.","fix":"- PostgreSQL 18: `18.7`\n- PostgreSQL 17: `17.12`\n- PostgreSQL 16: `16.16`\n- PostgreSQL 15: `15.20`\n- PostgreSQL 14: `14.25`","status":"open","published_at":"2026-11-12T15:17:42+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","triaged_at":"2026-11-12T15:43:19+00:00","updated_at":"2026-11-12T15:43:19+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:19Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL 18: `18.7`\n- PostgreSQL 17: `17.12`\n- PostgreSQL 16: `16.16`\n- PostgreSQL 15: `15.20`\n- PostgreSQL 14: `14.25`","reach":"network","title":"PostgreSQL: integer wraparound in tuple sizing lets a database user run code","impact":"high","summary":"PostgreSQL miscalculates in-memory tuple sizes because of an integer wraparound when handling oversized tuple data. A database user can use this to execute arbitrary code as the operating system user running the database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Database user runs code as the database server's OS user","analyst_note":"","how_to_check":"- Run `psql -c \"SHOW server_version;\"` and compare against the fixed versions below.\n- Check that the PostgreSQL server is at or above the fixed release for its major version.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","managed-hosting-patched"],"who_is_affected":"Any PostgreSQL server earlier than the fixed versions listed is affected. The attacker needs a database login, so exposure depends on who can connect and run queries. Servers where only trusted application roles can log in carry lower risk, but the flaw still matters for shared or multi-tenant databases.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":4559,"output_tokens":561,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120139':15A,18A '-2026':14A,17A '14.25':99C '15.20':97C '16.16':96C '17.12':95C '18.7':94C 'affect':101C 'allow':71C 'arbitrari':50B,77C 'calcul':70C 'code':12A,51B,78C 'cve':13A,16A 'data':41B,90C 'databas':9A,19B,43B,59B,73C,86C 'execut':49B,76C 'handl':38B 'host':24B 'in-memori':27B,64C 'integ':2A,35B,60C 'let':7A 'memori':29B,66C 'miscalcul':26B 'oper':54B,81C 'overs':39B,88C 'postgresql':1A,20B,25B,63C,93C 'run':11A,57B,84C 'runtim':21B 'self':23B 'self-host':22B 'size':6A,31B,69C 'system':55B,82C 'tupl':5A,30B,40B,68C,89C 'tuple-s':67C 'use':46B 'user':10A,44B,56B,74C,83C 'version':91C 'via':87C 'wraparound':3A,36B,61C","nicknames":[],"mitigations":[],"who_affected":"Any PostgreSQL server earlier than the fixed versions listed is affected. The attacker needs a database login, so exposure depends on who can connect and run queries. Servers where only trusted application roles can log in carry lower risk, but the flaw still matters for shared or multi-tenant databases.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-120139':15A,18A '-2026':14A,17A 'code':12A 'cve':13A,16A 'databas':9A 'integ':2A 'let':7A 'postgresql':1A 'run':11A 'size':6A 'tupl':5A 'user':10A 'wraparound':3A","search_b":"'arbitrari':50B 'code':51B 'data':41B 'databas':19B,43B,59B 'execut':49B 'handl':38B 'host':24B 'in-memori':27B 'integ':35B 'memori':29B 'miscalcul':26B 'oper':54B 'overs':39B 'postgresql':20B,25B 'run':57B 'runtim':21B 'self':23B 'self-host':22B 'size':31B 'system':55B 'tupl':30B,40B 'use':46B 'user':44B,56B 'wraparound':36B","search_c":"'14.25':99C '15.20':97C '16.16':96C '17.12':95C '18.7':94C 'affect':101C 'allow':71C 'arbitrari':77C 'calcul':70C 'code':78C 'data':90C 'databas':73C,86C 'execut':76C 'in-memori':64C 'integ':60C 'memori':66C 'oper':81C 'overs':88C 'postgresql':63C,93C 'run':84C 'size':69C 'system':82C 'tupl':68C,89C 'tuple-s':67C 'user':74C,83C 'version':91C 'via':87C 'wraparound':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120139","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120139","severity":null,"published_at":"2026-11-12T15:17:42+00:00","modified_at":"2026-11-12T15:17:42+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","fetched_at":"2026-11-12T15:41:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}