CVE-2026-120147 PostgreSQL dblink reentrant disconnect use-after-free executes arbitrary code
An object creator can execute code as the database OS user via reentrant dblink use-after-free in PostgreSQL; PostgreSQL administrators should care.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Harmful if only installed
- No
- Needs a specific call
- No
- Fix
- Available
What is CVE-2026-120147?
CVE-2026-120147 is a high-severity use after free vulnerability in PostgreSQL, published on 12 Nov 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running the database, via type conversion code that re-enters dblink and closes a connection whose results an outer dblink call is reading. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Weakness: CWE-416
Which versions are affected by CVE-2026-120147?
Only installations with a non-default setting turned on are exposed.
How do I fix CVE-2026-120147?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-120147 being exploited?
There is no known exploitation of CVE-2026-120147 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-120147, DEBIAN-CVE-2026-120147, ECHO-9501-1724-f6ac, GHSA-63j6-rm8q-mhqx.