PostgreSQL Arbitrary Code Execution Flaws Fixed in 18.7, 17.12, 16.16, 15.20 and 14.25

TL;DR

PostgreSQL released versions 18.7, 17.12, 16.16, 15.20 and 14.25 on November 12, 2026, fixing 52 CVEs. This PostgreSQL security update is far larger than recent releases. In 32 of the flaws, an authenticated user could run arbitrary code on the database server.

Most of the 52 flaws let a database user, or a user who can create objects, run code as the operating system account behind PostgreSQL. The release is also the final one for PostgreSQL 14. No exploitation or public proof-of-concept has been confirmed.

Notable CVEs

Why It Matters

The batch is unusually large. HeroDevs counted 28 security fixes in the August release and called it the most PostgreSQL had fixed at once. This PostgreSQL security update nearly doubles that number.

Furthermore, 32 of the 52 CVEs score 8.8. Each one can turn a normal database account into code execution on the host. On shared or hosted databases, that can break the boundary between tenants and the server.

PostgreSQL 14 also reaches end of life with this release. The PostgreSQL release announcement states: “This is the final release of PostgreSQL 14.” After this, the branch “will no longer receive security and bug fixes.”

How the Attack Works

Memory Safety Bugs

Most flaws are type confusion, use-after-free or buffer overflow bugs. CVE-2026-6460 is typical. An attacker who can create objects changes a column’s data type, and stale values then confuse the server. The advisory adds that “other DDL attack routes exist.”

Other bugs hit the PL/Perl and PL/Tcl languages, dblink, triggers and text search functions. Several need only an ordinary database login, such as CVE-2026-120141 and CVE-2026-120139.

Replication and Client Tools

Some flaws reverse the usual direction of attack. With CVE-2026-120145, a compromised publisher can run code on a subscriber, but only when a superuser owns the subscription. In the same way, CVE-2026-120149 lets a hostile foreign server attack the database that queries it.

Client tools are affected too. Crafted archives can run code through pg_restore (CVE-2026-116314). Similarly, pg_dump, reindexdb and vacuumdb have SQL injection or search path flaws.

Lower-Severity Issues

The rest include memory leaks, row-level security bypasses and privilege checks that roles can skip. One flaw, CVE-2026-116322, lets an unauthenticated client trigger a server restart on PostgreSQL 18.

Affected Versions

• PostgreSQL 18 before 18.7
• PostgreSQL 17 before 17.12
• PostgreSQL 16 before 16.16
• PostgreSQL 15 before 15.20
• PostgreSQL 14 before 14.25

Some flaws affect only newer branches. For example, CVE-2026-116329 and CVE-2026-116318 affect only PostgreSQL 18.

Patch and Mitigation

Install this PostgreSQL security update for your branch. According to the project, “you may simply stop PostgreSQL and update its binaries.” No dump and reload is needed.

However, check the post-update steps. The release also fixes index corruption bugs, so some GIN, pg_trgm GiST and bpchar B-tree indexes need a reindex. If you use incremental backups, take a new full backup after updating.

Next, review who holds CREATE privileges, since most code execution paths start there. Restore dumps only from trusted sources. Finally, plan a move off PostgreSQL 14. PostgreSQL 19 is due for general availability on November 19, 2026.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of Daily CyberSecurity. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.