Description

Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T13:17:44.530Z",
  "pubdate": "2026-08-13T13:17:44.530Z",
  "executiveSummary": "A type confusion vulnerability exists within the PostgreSQL module \"refint\", allowing an authenticated object creator to execute arbitrary code with the privileges of the operating system user running the database instance.\nThe vulnerability impacts PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24.\nThe flaw introduces severe risk implications, as it bridges database-level object creation capabilities directly to host-level code execution, completely compromising the confidentiality, integrity, and availability of the underlying system.\nAn attacker must possess sufficient privileges to create database objects to leverage this vulnerability.\nThe issue stems from internal plan caching mechanisms within the affected module, which were ultimately addressed by removing the plan cache in the fix identified by the subject \"refint: Remove plan cache.\"",
  "technicalDetails": "The root cause of the vulnerability is a type confusion flaw residing in the PostgreSQL \"refint\" (referential integrity) extension module.\nType confusion vulnerabilities occur when a program allocates a resource of a specific type but accesses or uses it as a different type, leading to unexpected memory manipulation, control flow hijacking, or arbitrary code execution.\nIn this scenario, the vulnerable component is the query plan caching implementation utilized by the \"refint\" module.\nExploitation requires an attacker to have permissions to create database objects, such as tables or triggers, enabling them to interact directly with the vulnerable execution paths of the \"refint\" functions.\nThe step-by-step attack flow begins with the malicious object creator establishing a database session and interacting with the \"refint\" module through crafted schema definitions or queries.\nDue to improper handling of internal data structures and types within the module's plan caching logic, the database engine misinterprets memory objects.\nThis type confusion corrupts internal execution structures, allowing the attacker to manipulate instruction pointers or function execution flows.\nAs a result, the payload execution occurs within the context of the database server process, inheriting the privileges of the operating system user running PostgreSQL.\nPost-exploitation impact includes full system compromise, escalation of privileges from database user to operating system user, unauthorized access to sensitive database stores, and potential lateral movement within the network.\nAffected versions include all PostgreSQL releases prior to 18.5, 17.11, 16.15, 15.19, and 14.24."
}