CVE-2026-120151 PostgreSQL plpgsql record-field type confusion executes arbitrary code

Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable's row type while a value is being cast. Versions before PostgreSQL 18.7,...

CVE-2026-120151

A type confusion vulnerability in the PostgreSQL plpgsql record-field assignment allows an attacker to execute arbitrary code as the operating system user running the database. The root cause is a reentrant domain CHECK that modifies a RECORD variable's row type during a value cast. Affected vers...