PostgreSQL: Arbitrary code execution via type-cache invalidation (CVE-2026-120144)
A type confusion vulnerability in PostgreSQL version 18 related to incomplete type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database.
CVE search metadata
CVE search record: CVE-2026-120144. Severity: high. CVSS: 8.8. KEV: no. Product: PostgreSQL (< 18.7). Brief: PostgreSQL: Arbitrary code execution via type-cache invalidation (CVE-2026-120144). Brief link: https://feed.craftedsignal.io/briefs/2026-11-postgresql-type-confusion-cve-2026-120144/
Triage facts
Revision 1- Applicability
- PostgreSQL (< 18.7)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 16:57 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-120144 describes a type confusion vulnerability in PostgreSQL major version 18 caused by incomplete type-cache invalidation. An object creator can trigger this flaw by modifying a composite type while its cache entry is being populated. Successful exploitation results in arbitrary code execution with the privileges of the operating system user running the PostgreSQL database process.
Recommendation
Upgrade instances to PostgreSQL 18.7 or later to address the vulnerability.