CVE-2026-16238 PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code
An object creator can execute arbitrary code as the database OS user via type confusion in pg_restore_attribute_stats.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-16238?
CVE-2026-16238 is a high-severity code injection vulnerability in Postgresql Postgresql, published on 13 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.
Weakness: CWE-843
Which versions are affected by CVE-2026-16238?
1 open source package ship an affected version, including postgresql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
postgresql Bitnami | From 18.0.0 | 18.5.0 |
Products include Postgresql Postgresql.
How do I fix CVE-2026-16238?
Upgrade postgresql to 18.5.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-16238 being exploited?
There is no known exploitation of CVE-2026-16238 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as ALPINE-CVE-2026-16238, BELL-CVE-2026-16238, BIT-postgresql-2026-16238, DEBIAN-CVE-2026-16238, GHSA-6q3v-qqc9-g2rv, MINI-fc59-4jvh-gf9c and 1 more.