First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-120139

HighCVSS 8.8/10Last modified Nov 13, 2026

Description

Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
n/a	PostgreSQL	>= 18, < 18.7; >= 17, < 17.12; >= 16, < 16.16; >= 15, < 15.20; < 14.25

References

https://www.postgresql.org/support/security/CVE-2026-120139/

Timeline

Published: Nov 12, 2026
Last modified: Nov 13, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-120148.3Use after free in Cast in Google Chrome prior to 149.0.7827.115 allowed an attacker on the local network segment to potentially perform a sa CVE-2026-1201418.8Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system u CVE-2026-1201428.8Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running CVE-2026-1201438.8Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the d CVE-2026-1201448.8Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system CVE-2026-1201458.8Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system use CVE-2026-1201464.3Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It al CVE-2026-1201478.8Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running th CVE-2026-1201488.1Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the CVE-2026-1201498.8Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inse CVE-2026-120155.3Use after free in Autofill in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to ob CVE-2026-1201508.8Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user r

CVE-2026-120139: High severity, CVSS 8.8 | Vulnix