Description

Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-13T13:17:44.137Z",
  "pubdate": "2026-08-13T13:17:44.137Z",
  "executiveSummary": "A type confusion vulnerability exists within the PostgreSQL ctid data type selectivity estimator, allowing an authenticated object creator to leak arbitrary memory contents.\nThe flaw enables an attacker with object creation privileges to supply a malformed, non-ctid input to the ctid selectivity estimator function.\nThis type confusion leads to the calculation of selectivity values derived from an arbitrary 4-byte span of server memory.\nWhile the calculation results in some loss of precision, substantial memory value recovery is achievable through repeated queries.\nAffected products include PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24.\nThe risk implications involve unauthorized disclosure of sensitive server memory contents, potentially exposing confidential data processed by the database engine.",
  "technicalDetails": "The root cause of the vulnerability lies in inadequate type validation and handling within the PostgreSQL selectivity estimator designed for the ctid data type.\nSelectivity estimators are internal functions used by the query planner to estimate the fraction of rows that will match a given condition.\nWhen processing the ctid data type, the estimator incorrectly interprets input data when a crafted, non-ctid input type is supplied by a user.\nBecause the function fails to enforce strict type safety checks, a type confusion condition arises where memory interpreted as a ctid structure actually references an unintended 4-byte span of arbitrary server memory.\nThe attack flow proceeds as follows: First, the attacker leverages object creation privileges to interact with the database engine. Second, the attacker formulates a malicious query or function call that passes a chosen non-ctid input into the vulnerable ctid selectivity estimator. Third, the database engine executes the estimator logic against the unintended memory region referenced due to the type confusion. Fourth, the estimator computes a selectivity value based on the targeted 4-byte memory span and returns this calculated metric as part of query planning statistics or execution results. Finally, the attacker observes the returned selectivity calculation and reverse-engineers the mathematical derivation to recover the underlying memory bytes.\nPrivilege requirements include the ability to create database objects, which is typically granted to standard database users by default.\nAuthentication is required to execute queries against the PostgreSQL instance.\nThe vulnerable component is the ctid selectivity estimator within the PostgreSQL query planning and optimization subsystem.\nAffected versions comprise PostgreSQL prior to 18.5, 17.11, 16.15, 15.19, and 14.24."
}