CVE-2026-16239CWE-843

CVE-2026-16239

High · published August 13, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
52.0
In the wild
Unconfirmed
What it is

Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00683 · 52.0th percentile
Weakness
CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
Published
2026-08-13T17:17Z
Affected products (5)
ProductVersionsFixed in
postgresql/postgresql≥ 14.0, < 14.2414.24
postgresql/postgresql≥ 15.0, < 15.1915.19
postgresql/postgresql≥ 16.0, < 16.1516.15
postgresql/postgresql≥ 17.0, < 17.1117.11
postgresql/postgresql≥ 18.0, < 18.518.5
References (1)
https://www.postgresql.org/support/security/CVE-2026-16239/ · f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
EPSS history
Timeline
  • 13 AUG 13:00Z
    PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code
    cvelistv5