CVE-2026-16238

PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code

Published: 8/13/2026 Last updated: 8/29/2026 Reserved: 7/20/2026

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

CNA assigner: PostgreSQL (f86ef6dc-4d3a-42ad-8f28-e6d5547a5007) Requested by: n/a

Metrics

Version	Score	Severity	Vector String
3.1	8.8	High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Opam packages affected (5)

conf-mingw-w64-postgresql-i686 conf-mingw-w64-postgresql-x86_64 conf-postgresql ocsigen-start postgresql

Products affected (0)

No product listed.

References (1)

https://www.postgresql.org/support/security/CVE-2026-16238/

Credits (1)

The PostgreSQL project thanks Amy Burnett (OpenAI Codex Security) for reporting this problem.