CVE-2026-120144

HighCVSS 8.8/10Last modified Nov 13, 2026

Description

Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 12, 2026
Last modified: Nov 13, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1201458.8Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system use CVE-2026-1201464.3Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It al CVE-2026-1201478.8Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running th CVE-2026-1201488.1Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the CVE-2026-1201498.8Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inse CVE-2026-120155.3Use after free in Autofill in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to ob CVE-2026-1201508.8Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user r CVE-2026-1201518.8Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user CVE-2026-1201524.3Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the funct CVE-2026-1201537.2SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code CVE-2026-1201544.3Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the t CVE-2026-120168.3Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer