CVE-2026-116310
PostgreSQL COPY error context uses freed field storage
Description
Use after free in PostgreSQL COPY FROM error reporting allows a database user to disclose portions of server memory, via a longer input row following an ignored or nullified conversion error. file_fdw reaches the same code path in affected version 18. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.
INFO
Published Date :
Nov. 12, 2026, 2:15 p.m.
Last Modified :
Nov. 12, 2026, 2:15 p.m.
Remotely Exploit :
Yes !
Source :
PostgreSQL
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 | ||||
| CVSS 3.1 | MEDIUM | MITRE-CVE |
Solution
- Update PostgreSQL to version 18.7 or 17.12 or later.
- Apply vendor patches for affected PostgreSQL versions.
- Monitor server memory for unexpected disclosures.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-116310 vulnerability anywhere in the article.