{"id":"CVE-2026-16238","state":"PUBLISHED","title":"PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code","description":"Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values.  Within major version 18, minor versions before PostgreSQL 18.6 are affected.  Versions before PostgreSQL 18 are unaffected.","publishedAt":"2026-08-13T13:00:12.450Z","updatedAt":"2026-08-29T23:07:28.490Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"PostgreSQL"},"assigner":"PostgreSQL","products":["n/a PostgreSQL"],"affected":[{"vendor":"n/a","product":"PostgreSQL","defaultStatus":"unaffected","versions":[{"version":"18","status":"affected","lessThan":"18.6","versionType":"rpm"}]}],"references":["https://www.postgresql.org/support/security/CVE-2026-16238/"],"weaknesses":["CWE-843"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/16xxx/CVE-2026-16238.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-16238","state":"PUBLISHED","datePublished":"2026-08-13T13:00:12.450Z","dateUpdated":"2026-08-29T23:07:28.490Z","assignerShortName":"PostgreSQL","assignerOrgId":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","dateReserved":"2026-07-20T01:55:07.055Z"},"containers":{"cna":{"title":"PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code","descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values.  Within major version 18, minor versions before PostgreSQL 18.6 are affected.  Versions before PostgreSQL 18 are unaffected."}],"affected":[{"vendor":"n/a","product":"PostgreSQL","defaultStatus":"unaffected","versions":[{"version":"18","status":"affected","lessThan":"18.6","versionType":"rpm"}]}],"references":[{"url":"https://www.postgresql.org/support/security/CVE-2026-16238/"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-843","lang":"en","type":"CWE","description":"Access of Resource Using Incompatible Type ('Type Confusion')"}]}],"providerMetadata":{"shortName":"PostgreSQL","orgId":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","dateUpdated":"2026-08-29T23:07:28.490Z"},"x_postgresql":{"component":"core server"},"configurations":[{"lang":"en","value":"attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"}],"workarounds":[{"lang":"en","value":"Revoke public EXECUTE permission on the function"}],"credits":[{"lang":"en","value":"The PostgreSQL project thanks Amy Burnett (OpenAI Codex Security) for reporting this problem."}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-13T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-16238"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-14T03:55:36.042Z"}}]}}}