CVE-2026-116328
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Nov 12, 2026
Vendor
unknown
Description
Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.