PostgreSQL dblink Use-After-Free (pre 18.7,17.12,16.16,15.20,14.25)
CVE-2026-120147 Published on November 12, 2026
PostgreSQL dblink reentrant disconnect use-after-free executes arbitrary code
Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running the database, via type conversion code that re-enters dblink and closes a connection whose results an outer dblink call is reading. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Vulnerability Analysis
Weakness Type
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2026-120147 has been classified to as a Dangling pointer vulnerability or weakness.
Products Associated with CVE-2026-120147
Want to know whenever a new CVE is published for PostgreSQL? stack.watch will email you.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.