CVE-2026-120148
Received Received - Intake

Type Confusion in PostgreSQL Extended Statistics

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: PostgreSQL

Description
Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-120148
EUVD
EUVD-2026-124422

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
postgresql postgresql to 18.7|end_excluding=17.12|end_excluding=16.16|end_excluding=15.20|end_excluding=14.25 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-843 The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a type confusion issue in PostgreSQL's extended statistics feature. It allows an attacker who creates a statistics object to execute arbitrary code as the operating system user running the database. The problem occurs when a statistics expression uses an anonymous RECORD type that incorrectly references a different row type in another session.

Detection Guidance

Detecting this vulnerability requires checking PostgreSQL version and reviewing statistics objects for suspicious RECORD types. Use 'SELECT version();' to check version. If running affected versions (before 18.7, 17.12, 16.16, 15.20, 14.25), inspect statistics objects with 'SELECT * FROM pg_statistic_ext;' for unusual RECORD type expressions.

Impact Analysis

An attacker could exploit this to run malicious code with the same privileges as the PostgreSQL database process. This could lead to unauthorized data access, modification, or system compromise. The impact includes potential data breaches, service disruption, or further lateral movement within the network.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using affected PostgreSQL versions may face compliance violations, legal penalties, or reputational damage due to potential data breaches.

Mitigation Strategies

Immediately upgrade PostgreSQL to version 18.7, 17.12, 16.16, 15.20, or 14.25 or later. Revoke unnecessary CREATE privileges for untrusted users. Monitor database logs for unusual statistics object creation activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120148. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...