PostgreSQL: Arbitrary code execution via materialized set-returning functions (CVE-2026-120141)
A type confusion vulnerability in PostgreSQL materialized set-returning functions, such as json_populate_recordset(), allows an authenticated database user to execute arbitrary code as the operating system user running the database.
CVE search metadata
CVE search record: CVE-2026-120141. Severity: high. CVSS: 8.8. KEV: no. Product: PostgreSQL. Brief: PostgreSQL: Arbitrary code execution via materialized set-returning functions (CVE-2026-120141). Brief link: https://feed.craftedsignal.io/briefs/2026-11-postgresql-type-confusion-cve-2026-120141/
Triage facts
Revision 1- Applicability
- PostgreSQL
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 16:57 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A type confusion vulnerability exists in PostgreSQL materialized set-returning functions (CVE-2026-120141). The issue arises when returning rows with different dynamic RECORD return types. An authenticated database user can exploit this to execute arbitrary code with the privileges of the operating system user running the database process.
Impact
Successful exploitation allows an authenticated database user to execute arbitrary code as the database process user.