PT-2026-145848

CVE-2026-18447

·

Published

2026-11-12

·

Updated

2026-11-12

Description by

CVSS 3.1
8.8
High
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type "any". Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-843: Access of Resource Using Incompatible Type (\'Type Confusion\')
Related identifiers
CVE-2026-18447
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com