PostgreSQL: Use-After-Free in plperl (CVE-2026-116320)
A use-after-free vulnerability in the PostgreSQL plperl extension allows an object creator to execute arbitrary code as the operating system user running the database.
CVE search metadata
CVE search record: CVE-2026-116320. Severity: high. CVSS: 8.8. KEV: no. Product: PostgreSQL. Brief: PostgreSQL: Use-After-Free in plperl (CVE-2026-116320). Brief link: https://feed.craftedsignal.io/briefs/2026-11-postgresql-plperl-uaf-cve-2026-116320/
Triage facts
Revision 1- Applicability
- PostgreSQL
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 16:55 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-116320 is a use-after-free vulnerability in the PostgreSQL plperl extension. The issue occurs when an object creator drops the final reference to a Perl array or hash while PostgreSQL is in the process of converting that object. This allows for the execution of arbitrary code as the operating system user running the database service.
Impact
Successful exploitation allows an attacker to execute arbitrary code with the privileges of the database service user.
Recommendation
Refer to the official PostgreSQL documentation for guidance on affected versions and security updates.