CVE-2026-16238 — PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code

CVE-2026-16238

PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code PUBLISHED

Description (CNA)

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

Affected (CNA)

Vendor / product	Versions
n/a / PostgreSQL	affected 18 before 18.6

CWE

CWE-843

References

https://www.postgresql.org/support/security/CVE-2026-16238/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.