CVE-2026-116314

Improper input validation in PostgreSQL pg restore allows a non-plain archive provider to execute arbitrary code as the operating system user running pg restore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination, but it does not legitimately confer arbitrary code execution in the pg restore OS process. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.