PostgreSQL up to 16.15/17.11/18.6 pg_show_all_settings use after free

Summaryinfo

A vulnerability was found in PostgreSQL up to 16.15/17.11/18.6. It has been classified as problematic. This issue affects the function pg_show_all_settings. The manipulation leads to use after free. This vulnerability is referenced as CVE-2026-120152. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in PostgreSQL up to 16.15/17.11/18.6. This issue affects the function pg_show_all_settings. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. Impacted is confidentiality. The summary by CVE is:

Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.

The advisory is shared at postgresql.org. The identification of this vulnerability is CVE-2026-120152 since 10/30/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available.

Upgrading to version 16.16, 17.12 or 18.7 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Database Software

Name

• PostgreSQL

Version

• 16.0
• 16.1
• 16.2
• 16.3
• 16.4
• 16.5
• 16.6
• 16.7
• 16.8
• 16.9
• 16.10
• 16.11
• 16.12
• 16.13
• 16.14
• 16.15
• 17.0
• 17.1
• 17.2
• 17.3
• 17.4
• 17.5
• 17.6
• 17.7
• 17.8
• 17.9
• 17.10
• 17.11
• 18.0
• 18.1
• 18.2
• 18.3
• 18.4
• 18.5
• 18.6

License

• open-source

Website

• Product: https://www.postgresql.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion