CVE-2026-116328

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 16.0 through 16.15 PostgreSQL versions 17.0 through 17.11 PostgreSQL versions 18.0 through 18.6

Description An integer wraparound issue exists in generation memory contexts. A database user can execute arbitrary code with the privileges of the operating system user running the database. This occurs when an allocation larger than 1 GB is freed, causing its block to be reused for smaller chunks where the back-pointer offset cannot represent that position.

Recommendations Update PostgreSQL version 16.x to 16.16 Update PostgreSQL version 17.x to 17.12 Update PostgreSQL version 18.x to 18.7