Description

Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T13:17:46.520Z",
  "pubdate": "2026-08-13T13:17:46.520Z",
  "executiveSummary": "A type confusion vulnerability exists within the portal and cursor lifecycle management of PostgreSQL, allowing an authenticated user to achieve arbitrary remote code execution under the privileges of the operating system user running the database instance.\nThe vulnerability affects PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24. Successful exploitation grants an attacker full code execution capabilities within the context of the database server process.\nThe flaw stems from improper handling of object types when re-creating a cursor or other portal structures with mismatched types, leading to memory corruption and subsequent control flow hijacking.\nAttackers require database access to instantiate cursors and manipulate portal lifecycles, making this a significant risk for environments that permit untrusted database user interactions.\nMitigation requires upgrading PostgreSQL to the patched versions specified by the vendor.",
  "technicalDetails": "The vulnerability is rooted in a type confusion flaw within the PostgreSQL backend code responsible for managing database portals and cursors.\nPostgreSQL utilizes internal data structures known as portals to manage the execution state of queries, statements, and cursors. During the lifecycle of a portal or cursor, internal state transitions and re-creations are handled dynamically.\nWhen a user re-creates an existing cursor or portal using differing internal types without proper validation or state resetting, the database engine misinterprets the underlying memory structures.\nThis type confusion condition allows an attacker to induce memory corruption, leading to arbitrary read and write primitives within the memory space of the PostgreSQL backend process.\nBy carefully crafting the sequence of cursor operations and manipulating the layout of heap structures, an attacker can overwrite critical function pointers or execution contexts.\nWhen the affected portal or cursor structure is subsequently referenced or executed, control flow is diverted to attacker-supplied shellcode or rop chains.\nThe attack flow begins with the attacker establishing a database session and issuing specially crafted SQL commands to define and repeatedly re-define cursors or portals with conflicting data types.\nExploitation requires the ability to execute queries against the database, meaning authentication is typically required, though the privileges can often be held by standard, unprivileged database users depending on server configuration.\nThe post-exploitation impact is severe, resulting in arbitrary code execution running directly as the operating system user account that executes the PostgreSQL daemon, potentially enabling full system compromise, lateral movement, and unauthorized access to underlying file systems and databases."
}