PostgreSQL up to 16.15/17.11/18.6 Generation Memory Contexts integer overflow

Summaryinfo

A vulnerability categorized as critical has been discovered in PostgreSQL up to 16.15/17.11/18.6. Affected by this issue is some unknown functionality of the component Generation Memory Contexts. Executing a manipulation can lead to integer overflow. This vulnerability is registered as CVE-2026-116328. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in PostgreSQL up to 16.15/17.11/18.6 and classified as critical. This vulnerability affects an unknown functionality of the component Generation Memory Contexts. The manipulation with an unknown input leads to a integer overflow vulnerability. The CWE definition for the vulnerability is CWE-190. The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.

The advisory is shared for download at postgresql.org. This vulnerability was named CVE-2026-116328 since 10/26/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are neither technical details nor an exploit publicly available.

Upgrading to version 16.16, 17.12 or 18.7 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Database Software

Name

• PostgreSQL

Version

• 16.0
• 16.1
• 16.2
• 16.3
• 16.4
• 16.5
• 16.6
• 16.7
• 16.8
• 16.9
• 16.10
• 16.11
• 16.12
• 16.13
• 16.14
• 16.15
• 17.0
• 17.1
• 17.2
• 17.3
• 17.4
• 17.5
• 17.6
• 17.7
• 17.8
• 17.9
• 17.10
• 17.11
• 18.0
• 18.1
• 18.2
• 18.3
• 18.4
• 18.5
• 18.6

License

• open-source

Website

• Product: https://www.postgresql.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion