What is CVE-2026-16238?

CVE-2026-16238 is a high-severity vulnerability in Postgresql, classified under Access of Resource Using Incompatible Type (Type Confusion). CVSS score: 8.8/10. Published 2026-08-13.

How severe is CVE-2026-16238?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Postgresql

CVE-2026-16238

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor…

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

N/a Postgresql — versions 18

Weakness classification (CWE)

CWE-843 — Access of Resource Using Incompatible Type (Type Confusion)

References

f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Frequently asked questions

What is CVE-2026-16238?: CVE-2026-16238 is a high-severity vulnerability in Postgresql, classified under Access of Resource Using Incompatible Type (Type Confusion). CVSS score: 8.8/10. Published 2026-08-13.
How severe is CVE-2026-16238?: High severity. CVSS v3 base score is 8.8 out of 10.