CVE-2026-116309

HighCVSS 8.8/10Last modified Nov 13, 2026

Description

Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL::InServer::ARRAY. We have not confirmed or ruled out a way to control the pointer sufficiently to achieve security impact, but we are proceeding as though that is possible. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 12, 2026
Last modified: Nov 13, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-116318.3Use after free in Aura in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer proces CVE-2026-1163104.3Use after free in PostgreSQL COPY FROM error reporting allows a database user to disclose portions of server memory, via a longer input row CVE-2026-1163115.4Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading CVE-2026-1163125.4Inconsistent transition-capture state in PostgreSQL MERGE allows a table data modifier to make an AFTER trigger process the wrong new row, v CVE-2026-1163137.2Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via sha CVE-2026-1163148.8Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the operating system use CVE-2026-1163158.8Heap-based buffer overflow in PostgreSQL tsvector_delete() allows a database user to execute arbitrary code as the operating system user run CVE-2026-1163168.8Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the CVE-2026-1163178.8Heap-based buffer overflow in PostgreSQL ts_rank_cd() may allow a database user to execute arbitrary code as the operating system user runni CVE-2026-1163188.8SQL injection in PostgreSQL pg_dump allows an object creator to execute arbitrary SQL as the user restoring the dump, via an inherited colum CVE-2026-1163198.8Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, vi CVE-2026-116327.5Use after free in TabStrip in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI