CVE-2026-116315

HighCVSS 8.8/10Last modified Nov 13, 2026

Description

Heap-based buffer overflow in PostgreSQL tsvector_delete() allows a database user to execute arbitrary code as the operating system user running the database, via a tsvector whose lexeme data uses a nonstandard but valid ordering that requires additional alignment padding in the result. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 12, 2026
Last modified: Nov 13, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1163168.8Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the CVE-2026-1163178.8Heap-based buffer overflow in PostgreSQL ts_rank_cd() may allow a database user to execute arbitrary code as the operating system user runni CVE-2026-1163188.8SQL injection in PostgreSQL pg_dump allows an object creator to execute arbitrary SQL as the user restoring the dump, via an inherited colum CVE-2026-1163198.8Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, vi CVE-2026-116327.5Use after free in TabStrip in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI CVE-2026-1163208.8Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, vi CVE-2026-1163214.3Improper null termination in PostgreSQL array element assignment allows a database user to disclose server memory, via changing the final by CVE-2026-1163225.3Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for au CVE-2026-1163238.8Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via CVE-2026-1163258.0SQL injection in PostgreSQL reindexdb allows an object creator to execute arbitrary SQL as the database user running reindexdb, via a crafte CVE-2026-1163268.8Uncaught exceptions in PostgreSQL plperl allow an object creator to cause use of a stale sigjmp_buf, via a tied Perl object, or a Perl objec CVE-2026-1163274.3Exposure of sensitive information in PostgreSQL security_barrier processing allows a database user to infer values hidden by a security_barr