PostgreSQL <18.5 Type Confusion in pg_restore_attribute_stats() risks OS exec
CVE-2026-16238 Published on August 13, 2026
PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code
Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before PostgreSQL 18 are unaffected.
Weakness Type
What is an Object Type Confusion Vulnerability?
The program allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
CVE-2026-16238 has been classified to as an Object Type Confusion vulnerability or weakness.
Products Associated with CVE-2026-16238
Want to know whenever a new CVE is published for PostgreSQL? stack.watch will email you.
