CVE-2026-16238 PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code

🗓️ 13 Aug 2026 13:00:12Reported by PostgreSQLType

Type confusion in PostgreSQL 18.5 pg_restore_attribute_stats() allows object creator to execute arbitrary OS code.

Reporter	Title	Published	Views	Family All 52
FreeBSD	PostgreSQL -- Multiple vulnerabilities	13 Aug 202600:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : postgresql18, postgresql18-contrib, postgresql18-llvmjit (ALAS2023-2026-2079)	31 Aug 202600:00	–	nessus
Tenable Nessus	FreeBSD : PostgreSQL -- Multiple vulnerabilities (05d311bc-9991-11f1-bc50-6cc21735f730)	17 Aug 202600:00	–	nessus
Tenable Nessus	openSUSE 16: libecpg6 / libpq5 / postgresql18 / postgresql18-contrib / etc (openSUSE-SU-2026:21703-1)	1 Sep 202600:00	–	nessus
Tenable Nessus	PostgreSQL 18.x < 18.6 Multiple Vulnerabilities	1 Sep 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-16238	13 Aug 202600:00	–	nessus
AlpineLinux	CVE-2026-16238	13 Aug 202613:00	–	alpinelinux
BDU FSTEC	The vulnerability of the pg_restore_attribute_stats() function in the PostgreSQL database management system, related to data type mixing errors, allows a hacker to execute arbitrary code.	20 Aug 202600:00	–	bdu_fstec
Circl	CVE-2026-16238	20 Aug 202615:07	–	circl
CVE	CVE-2026-16238	13 Aug 202613:00	–	cve

[
  {
    "defaultStatus": "unaffected",
    "product": "PostgreSQL",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "18.6",
        "status": "affected",
        "version": "18",
        "versionType": "rpm"
      }
    ]
  }
]

Source	Link
postgresql	www.postgresql.org/support/security/CVE-2026-16238/

29 Aug 2026 23:07Current

CVSS 3.18.8

EPSS0.00414

CWE-843