Description

Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T13:17:45.400Z",
  "pubdate": "2026-08-13T13:17:45.400Z",
  "executiveSummary": "A type confusion vulnerability exists in PostgreSQL related to the handling of internal data type arguments. This vulnerability allows any authenticated database user to execute arbitrary operating system code under the privileges of the OS user running the database instance.\nThe flaw stems from insufficient input validation and security enforcement mechanisms intended to restrict direct SQL calls to functions accepting the internal pseudo-type, which represents mutually-incompatible data structures not meant for direct exposure to users.\nAffected products include PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24. Successful exploitation grants attackers complete control over the underlying host operating system via the database service account, presenting a critical risk to confidentiality, integrity, and availability.\nAttacker capabilities include arbitrary code execution within the context of the database server process. Exploitation requires the ability to execute functions within the database environment, bypassing intended access controls due to gaps in the system's function call prevention logic.",
  "technicalDetails": "The root cause of the vulnerability resides in a type confusion flaw within PostgreSQL function dispatch and argument validation logic. The internal pseudo-type in PostgreSQL designates a class of mutually-incompatible data structures that are strictly intended for internal database engine use and are explicitly prohibited from direct access via standard SQL queries.\nThe database management system includes prevention mechanisms designed to block direct user calls to functions that accept internal data type arguments. However, gaps in these preventative controls allow malicious or unprivileged database users to bypass restrictions through crafted function invocations, leveraging type confusion conditions.\nThe attack flow begins with an authenticated database user identifying or interacting with vulnerable functions that accept the internal argument type. By supplying manipulated arguments or exploiting the type confusion logic gap, the attacker induces the database engine to misinterpret data structures.\nThis misinterpretation leads to memory corruption or unsafe execution paths within the database server process. Because the database engine executes with the privileges of the operating system user running the database daemon, this execution flaw culminates in arbitrary operating system command execution.\nAffected software versions include PostgreSQL prior to 18.5, 17.11, 16.15, 15.19, and 14.24. The vulnerability involves the core function execution and type checking components of the database engine.\nAuthentication requirements dictate that the attacker must have access to execute functions within the database, though privilege requirements to access the specific vulnerable functions are bypassed due to the control-flow gap. The attack vector is local or network-based depending on database access permissions, allowing payload behavior that executes arbitrary OS-level commands."
}