PostgreSQL: Type confusion in anonymous RECORD types (CVE-2026-120142)
A type confusion vulnerability in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database.
CVE search metadata
CVE search record: CVE-2026-120142. Severity: high. CVSS: 8.8. KEV: no. Product: PostgreSQL (< 18.7, < 17.12). Brief: PostgreSQL: Type confusion in anonymous RECORD types (CVE-2026-120142). Brief link: https://feed.craftedsignal.io/briefs/2026-11-postgresql-type-confusion-cve-2026-120142/
Triage facts
Revision 1- Applicability
- PostgreSQL (< 18.7, < 17.12)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 16:57 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A type confusion vulnerability (CVE-2026-120142) exists in PostgreSQL involving anonymous RECORD types. The issue allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments. This affects PostgreSQL major versions 17-18, specifically minor versions before 18.7 and 17.12.