{"id":"CVE-2026-16238","year":2026,"sequence":16238,"component":"core server","score":8.8,"cvss_version":"3.0","vector":"AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","first_published":"2026-08-13","source_url":"https://www.postgresql.org/support/security/CVE-2026-16238/","facts":{"affected":{"18":"18"},"affected_ranges":[{"from":"18","until":"18.6"}],"cna_url":"https://cveawg.mitre.org/api/cve/CVE-2026-16238","component":"core server","cvss_version":"3.0","description_en":"Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.","first_published":"2026-08-13","fixed":{"18":"18.6"},"id":"CVE-2026-16238","introduced":{},"published":{"18":"2026-08-13"},"score":8.8,"title":"PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code","url":"https://www.postgresql.org/support/security/CVE-2026-16238/","vector":"AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"reviewed_hash":"6a65a7884245936f6adaef8709d290d460e999dfce1ad78734fa7c9a324ed325","source_hash":"965b9e2323feab543f3cbeb74c418c3a5b43cbefc6594d2862ff0d24dcf8e6a2","text":{"locale":"en","title":"PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code","description":"Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.","details":null,"format":"plain","provenance":{"fetched_at":"2026-09-26T10:56:06+00:00","path":"compare/security.json","root":"source-data","sha256":"6a65a7884245936f6adaef8709d290d460e999dfce1ad78734fa7c9a324ed325","source_archive_sha256":"8d8ad63581e1d27b3a0f995ded3feb81c265e38b2ac652eb22f022f52c2240ec","source_revision":"004bc292ee31c11f9a41ab007e9d8116bce29a71","source_url":"https://www.postgresql.org/support/security/"},"text_hash":"ce5fda1bc7cee01b1ead045ddf858908eaece5310a7d4a060d87850b66d2f316"},"locales":["en","zh-Hans"],"fixes":[{"major":"18","fixed_version":"18.6","introduced":null,"published_date":"2026-08-13","facts":{"fixed":"18.6","introduced":null,"published":"2026-08-13"}}],"legacy":[{"source":"center","source_id":84,"observed_at":"2026-10-03 12:08:35.169032+08","raw":{"id":84,"cve":"2026-16238","public":true,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","details":"PostgreSQL pg_restore_attribute_stats() 存在类型混淆，对象创建者可通过混淆范围值与多重范围值， 以数据库服务所使用的操作系统用户身份执行任意代码。在主版本 18 中，PostgreSQL 18.6 之前的小版本 受此问题影响；PostgreSQL 18 之前的版本不受影响。","component":"core server","cvenumber":202616238,"description":"PostgreSQL pg_restore_attribute_stats() 类型混淆可导致任意代码执行","detailslink":"","legacyscore":"","newspost_id":3365},"fixes":[{"source_id":341,"source_version_id":31,"major":"18","fixed_minor":6,"raw":{"id":341,"patch_id":84,"version_id":31,"fixed_minor":6},"version_raw":{"id":31,"tree":18.0,"current":true,"docsgit":"","eoldate":"2030-11-14","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T08:10:47.078613+08:00","latestminor":6,"firstreldate":"2025-09-25"}}]},{"source":"pgweb","source_id":84,"observed_at":"2026-10-03 12:08:55.967155+08","raw":{"id":84,"cve":"2026-16238","public":true,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","details":"PostgreSQL pg_restore_attribute_stats() 存在类型混淆，对象创建者可通过混淆范围值与多重范围值， 以数据库服务所使用的操作系统用户身份执行任意代码。在主版本 18 中，PostgreSQL 18.6 之前的小版本 受此问题影响；PostgreSQL 18 之前的版本不受影响。","component":"core server","cvenumber":202616238,"description":"PostgreSQL pg_restore_attribute_stats() 类型混淆可导致任意代码执行","detailslink":"","legacyscore":"","newspost_id":3365},"fixes":[{"source_id":341,"source_version_id":31,"major":"18","fixed_minor":6,"raw":{"id":341,"patch_id":84,"version_id":31,"fixed_minor":6},"version_raw":{"id":31,"tree":18.0,"current":true,"docsgit":"","eoldate":"2030-11-14","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T00:10:45.258078+08:00","latestminor":6,"firstreldate":"2025-09-25"}}]}]}