PostgreSQL Type Confusion RCE Vulnerability (CVE-2026-16238) Advisory

Vulnerability Overview CVE ID: CVE-2026-16238 Vulnerability Description: A type confusion vulnerability in PostgreSQL, specifically in the function. This vulnerability allows an object creator to execute arbitrary code as the operating system user running the database by exploiting confusion between range and multivalued parameters. Affected Versions Affected Versions: Major version PostgreSQL 18, and minor versions prior to PostgreSQL 18.5. Unaffected Versions: Versions prior to PostgreSQL 18. Remediation Fixed Version: PostgreSQL 18.5 Release Date: 2026-08-13 CVSS 3.0 Score Overall Score: 8.8 Component: core server Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Report a Security Vulnerability To report a new security vulnerability, please email security@postgresql.org. To report non-security bugs, please refer to the Bug Report page. Version Information Affected Version: 18 Fixed Version: 18.5 Release Date: 2026-08-13 More Information For more details on PostgreSQL versioning, please visit the versioning page. Other Links Support: Support Versioning Policy: Versioning Policy Security: Security Professional Services: Professional Services Hosting Solutions: Hosting Solutions Report a Bug: Report a Bug Footer Policies: Policies Code of Conduct: Code of Conduct About PostgreSQL: About PostgreSQL Contact: Contact Copyright: © 1996-2026 The PostgreSQL Global Development Group Navigation Bar Home: Home About: About Download: Download Documentation: Documentation Community: Community Developers: Developers Support: Support Donate: Donate Your account: Your account Quick Links Support: Support Versioning Policy: Versioning Policy Security: Security Professional Services: Professional Services Hosting Solutions: Hosting Solutions Report a Bug: Report a Bug Top of Page Notification Release Date: August 13, 2026 Version Update: PostgreSQL 18.6, 17.11, 16.15, 15.19, 14.24 and 19 Beta 3 are now available! Bottom of Page Copyright: © 1996-2026 The PostgreSQL Global Development Group Top of Page Navigation Home: Home About: About Download: Download Documentation: Documentation Community: Community Developers: Developers Support: Support Donate: Donate Your account: Your account Top of Page Search Search: Search Top of Page Theme Toggle Theme Toggle: Theme Toggle Top of Page Language Selection Language Selection: Language Selection Top of Page Help Help: Help Top of Page Feedback Feedback: Feedback Top of Page Contribute Contribute: Contribute Top of Page Sponsor Sponsor: Sponsor Top of Page Partners Partners: Partners Top of Page Media Media: Media Top of Page Events Events: Events Top of Page Blog Blog: Blog Top of Page News News: News Top of Page Announcements Announcements: Announcements Top of Page FAQ FAQ: FAQ Top of Page Support Support: Support Top of Page Documentation Documentation: Documentation Top of Page Download Download: Download Top of Page About About: About Top of Page Home Home: Home Top of Page Navigation Home: Home About: About Download: Download Documentation: Documentation Community: Community Developers: Developers Support: Support Donate: Donate Your account: Your account Top of Page Search Search: Search Top of Page Theme Toggle Theme Toggle: Theme Toggle Top of Page Language Selection Language Selection: Language Selection Top of Page Help Help: Help Top of Page Feedback Feedback: Feedback Top of Page Contribute Contribute: Contribute Top of Page Sponsor Sponsor: Sponsor Top of Page Partners Partners: Partners Top of Page Media Media: Media Top of Page Events Events: Events Top of Page Blog Blog: Blog Top of Page News News: News Top of Page Announcements Announcements: Announcements Top of Page FAQ FAQ: FAQ Top of Page Support Support: Support Top of Page Documentation Documentation: Documentation Top of Page Download Download: Download Top of Page About About: About Top of Page Home Home: Home Top of Page Navigation Home: Home About: About Download: Download Documentation: Documentation Community: Community Developers: Developers Support: Support Donate: Donate Your account: Your account Top of Page Search Search: Search Top of Page Theme Toggle Theme Toggle: Theme Toggle Top of Page Language Selection Language Selection: Language Selection Top of Page Help Help: Help Top of Page Feedback Feedback: Feedback Top of Page Contribute Contribute: Contribute Top of Page Sponsor Sponsor: Sponsor Top of Page Partners Partners: Partners Top of Page Media Media: Media Top of Page Events Events: Events Top of Page Blog Blog: Blog Top of Page News News: News Top of Page Announcements Announcements: Announcements Top of Page FAQ FAQ: FAQ Top of Page Support Support: Support Top of Page Documentation Documentation: Documentation Top of Page Download Download: Download Top of Page About About: About Top of Page Home Home: Home Top of Page Navigation Home: Home About: About Download: Download Documentation: Documentation Community: Community Developers: Developers Support: Support Donate: Donate Your account: Y

Goal Reached Thanks to every supporter — we hit 100%!

PostgreSQL Type Confusion RCE Vulnerability (CVE-2026-16238) Advisory