First Published: 2026/08/13
Important: This assessment evaluates the impact of CVE-2026-16238 on EDB products and services. It links to and details the CVE and supplements that information with EDB's own assessment.
Summary
Type confusion in PostgreSQL's pg_restore_attribute_stats() function, arising from conflation of range and multirange values, allows an object creator to execute arbitrary code as the operating system user running the database. This vulnerability only affects PostgreSQL 18.x; versions before PostgreSQL 18.5 are affected. PostgreSQL 17 and earlier are not affected.
Vulnerability details
CVE-ID: CVE-2026-16238
CVE Publish Date: 2026/08/13
CVSS Base Score: 8.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products and versions
PostgreSQL
- All versions prior to 18.5
Versions prior to 18.0 are not affected.
EnterpriseDB Postgres Advanced Server (EPAS)
- All versions prior to 18.5
EnterpriseDB Postgres Extended (PGE)
- All versions prior to 18.5
CloudNativePG
- All operand versions prior to 18.5
Operand versions prior to 18.0 are not affected.
Remediation/fixes
PostgreSQL
| Affected Version | Fixed In | Fix Published |
|---|---|---|
| prior to 18.5 | 18.5 | 2026-08-13 |
EDB Postgres Extended Server
| Affected Version | Fixed In | Fix Published |
|---|---|---|
| prior to 18.5 | 18.5 | 2026-08-13 |
EDB Postgres Advanced Server
| Affected Version | Fixed In | Fix Published |
|---|---|---|
| prior to 18.5 | 18.5 | 2026-08-13 |
CloudNativePG
Customer should update to the fixed version of the PostgreSQL operands.
References
- CVSS Calculator v3.1
- NVD - CVE-2026-16238 Detail
- https://www.postgresql.org/support/security/CVE-2026-16238/
Related information
Acknowledgement
Source: PostgreSQL.org