CVE-2026-18447

HighCVSS 8.8/10Last modified Nov 12, 2026

Description

Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type "any". Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
n/a	PostgreSQL	>= 18, < 18.7; >= 17, < 17.12; >= 16, < 16.16; >= 15, < 15.20; < 14.25

References

https://www.postgresql.org/support/security/CVE-2026-18447/

Timeline

Published: Nov 12, 2026
Last modified: Nov 12, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-184485.6EDK2 contains a vulnerability in BIOS where a privileged attacker may cause “Exposure of Sensitive Information during Transient Execution” b CVE-2026-184497.5The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that ex CVE-2026-18455.5The Real Estate Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includin CVE-2026-184509.8The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that ex CVE-2026-184513.1The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker CVE-2026-1845210.0DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a CVE-2026-184537.5A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthent CVE-2026-184578.3Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. This issue affects Connext Pr CVE-2026-184586.8Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerab CVE-2026-184598.7Incorrect Calculation vulnerability in RTI Connext Professional (Core Libraries) allows Abuse Existing Functionality. This issue affects Con CVE-2026-184606.9Off-by-one Error, Out-of-bounds Write vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. This issue affects CVE-2026-184619.2Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection. This i