CVE-2026-16239
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types.
Risk Assessment
Risk of arbitrary code execution on the database server, potentially leading to full system compromise and data confidentiality breaches.
Recommendation
Update PostgreSQL to versions 18.5, 17.11, 16.15, 15.19, or 14.24 or later, which include a fix for this vulnerability.
Original NVD description (English source)
Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.