CVE-2026-16238 in PostgreSQL
Summary
by MITRE • 08/13/2026
Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before PostgreSQL 18 are unaffected.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a critical type confusion flaw in PostgreSQL's pg_restore_attribute_stats() function that enables privilege escalation through improper handling of data type conversions. The issue stems from the database's inability to properly distinguish between range and multirange data types during attribute statistics restoration, creating a scenario where maliciously crafted input can cause the system to execute unintended code with the privileges of the database service account. This vulnerability exists within PostgreSQL versions up to major version 18, specifically affecting minor versions prior to 18.5, while versions before 18 remain unaffected. The flaw falls under CWE-129 Input Validation and Output Encoding, specifically manifesting as a type confusion error that allows attackers to manipulate the execution flow of database operations. According to ATT&CK framework, this vulnerability maps to T1068 Valid Accounts and T1548.001 Account Manipulation, as it enables an attacker with object creation privileges to escalate their access rights within the database environment.
The technical exploitation occurs when an authenticated user creates a malicious object that triggers the pg_restore_attribute_stats() function with malformed range or multirange values. This type confusion allows the database engine to incorrectly interpret data types, leading to memory corruption and potential code execution in the context of the database service account. The vulnerability is particularly dangerous because it requires only object creation privileges rather than administrative access, making it accessible to users who can create database objects but not directly execute system commands. Attackers can leverage this flaw by crafting specific range or multirange data structures that cause the function to treat one data type as another, potentially leading to buffer overflows, arbitrary code execution, or denial of service conditions.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it fundamentally compromises database security integrity and can lead to complete system compromise when combined with other attack vectors. Organizations running PostgreSQL versions prior to 18.5 face significant risk since the database service typically runs with elevated privileges on the operating system level. This means that successful exploitation could allow attackers to access sensitive data, modify database contents, or even escalate to full system control depending on the database service account permissions. The vulnerability affects database administrators who may not be aware of the privilege boundaries, particularly in environments where standard users have object creation rights but should not possess elevated system privileges. Security teams must consider this vulnerability as part of their risk assessment for PostgreSQL deployments and implement appropriate monitoring and mitigation strategies.
Mitigation strategies should focus on immediate patching of affected PostgreSQL versions to 18.5 or later, while implementing additional security controls such as restricting object creation privileges to only trusted users, monitoring database activity for suspicious range or multirange operations, and conducting regular security audits of database configurations. Organizations should also consider implementing network segmentation and least privilege access controls around database servers to limit potential damage from successful exploitation attempts. The vulnerability highlights the importance of proper input validation and type safety in database engine implementations, particularly when dealing with complex data types that require careful handling during restoration operations. Security monitoring should include detection of unusual pattern matching between range and multirange data structures within database backup and restore operations, as this specific behavior is indicative of the underlying type confusion vulnerability that could be exploited for arbitrary code execution.