PostgreSQL up to 17.11/18.6 Error Reporting use after free

Summaryinfo

A vulnerability classified as problematic has been found in PostgreSQL up to 17.11/18.6. This vulnerability affects unknown code of the component Error Reporting. This manipulation causes use after free. This vulnerability is handled as CVE-2026-116310. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in PostgreSQL up to 17.11/18.6 and classified as problematic. Affected by this vulnerability is some unknown processing of the component Error Reporting. The manipulation with an unknown input leads to a use after free vulnerability. The CWE definition for the vulnerability is CWE-416. The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. As an impact it is known to affect confidentiality. The summary by CVE is:

Use after free in PostgreSQL COPY FROM error reporting allows a database user to disclose portions of server memory, via a longer input row following an ignored or nullified conversion error. file_fdw reaches the same code path in affected version 18. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.

It is possible to read the advisory at postgresql.org. This vulnerability is known as CVE-2026-116310 since 10/26/2026. The exploitation appears to be easy. The attack can be launched remotely. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 17.12 or 18.7 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Database Software

Name

• PostgreSQL

Version

• 17.0
• 17.1
• 17.2
• 17.3
• 17.4
• 17.5
• 17.6
• 17.7
• 17.8
• 17.9
• 17.10
• 17.11
• 18.0
• 18.1
• 18.2
• 18.3
• 18.4
• 18.5
• 18.6

License

• open-source

Website

• Product: https://www.postgresql.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion