Description

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before PostgreSQL 18 are unaffected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T13:17:46.383Z",
  "pubdate": "2026-08-13T13:17:46.383Z",
  "executiveSummary": "A type confusion vulnerability exists in PostgreSQL within the pg_restore_attribute_stats() function, allowing an authenticated database object creator to achieve arbitrary operating system code execution under the privileges of the user running the database instance.\nThe vulnerability specifically impacts PostgreSQL major version 18, with minor versions prior to PostgreSQL 18.5 being susceptible, while versions prior to PostgreSQL 18 remain unaffected.\nThe root cause stems from the conflation of range and multirange values during the restoration of attribute statistics.\nAn attacker must possess the ability to create database objects to trigger the flawed code path, leveraging crafted range and multirange data structures to corrupt memory or manipulate internal type representations.\nSuccessful exploitation compromises the underlying operating system host, leading to a complete breach of confidentiality, integrity, and availability for the database server and associated system resources.\nThis represents a severe security risk, particularly in multi-tenant environments where unprivileged users are granted object creation privileges.",
  "technicalDetails": "The vulnerability resides in the PostgreSQL database management system, specifically within the pg_restore_attribute_stats() function handling statistics restoration.\nThe affected versions are limited to PostgreSQL major version 18, specifically minor versions before PostgreSQL 18.5.\nThe root cause of the vulnerability is a type confusion flaw caused by the improper handling and conflation of range and multirange values.\nDuring the processing and restoration of attribute statistics, the database engine misinterprets the underlying data types of range objects as multirange objects, or vice versa.\nThis type mismatch leads to incorrect memory offset calculations, unsafe type casting, or memory corruption when internal functions attempt to operate on the misidentified data structures.\nTo initiate the attack flow, an adversary requires the capability to create database objects, such as tables or custom data types, within the PostgreSQL instance, implying a requirement for basic database authentication and object creation privileges.\nThe attacker crafts malicious database statistics containing specifically manipulated range and multirange values designed to exploit the type confusion condition inside pg_restore_attribute_stats().\nWhen the vulnerable function processes these statistics during specific restore or maintenance operations, the type confusion triggers memory corruption or logic flaws.\nThis aberrant behavior can be leveraged to overwrite critical memory structures, facilitating arbitrary code execution.\nThe post-exploitation impact allows the attacker to execute arbitrary shell commands or system binaries with the exact permissions of the operating system user account executing the PostgreSQL server process, typically the postgres user.\nNo network exposure beyond standard database connectivity with object creation privileges is strictly required, as the vector is driven by internal database interactions and analytical data processing."
}