PostgreSQL fixes 52 flaws, including code execution bugs

PostgreSQL released versions 18.7, 17.12, 16.16, 15.20 and 14.25 on 12 November 2026, fixing 52 CVEs: 38 rated High, 12 Medium and two Low. SecurityOnline says 32 flaws could allow an authenticated database user, or someone able to create objects, to execute code as the operating-system account running PostgreSQL. The highest listed rating is 8.8, including CVE-2026-6460. No exploitation or public proof-of-concept has been confirmed.

The issues include type confusion, use-after-free and buffer overflow bugs, as well as flaws in PL/Perl, PL/Tcl, dblink, triggers and text search. Some affect replication and client tools: a compromised publisher could attack a subscriber under the condition that a superuser owns the subscription, while crafted archives could trigger code execution through pg_restore. The release also addresses memory leaks, row-level security bypasses and privilege-check weaknesses.

CVE-2026-116322 could let an unauthenticated client restart a PostgreSQL 18 server. Affected releases are versions before 18.7, 17.12, 16.16, 15.20 and 14.25; some flaws affect only newer branches.

The PostgreSQL project says administrators can stop PostgreSQL and update its binaries without dumping and reloading data. Some GIN, pg_trgm GiST and bpchar B-tree indexes may need reindexing because the release fixes index-corruption bugs. Users of incremental backups should take a new full backup after updating. Version 14.25 is the final PostgreSQL 14 release, and that branch will receive no further security or bug fixes.