Quick answers
- Is CVE-2026-116333 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116333 being exploited in the wild.
- How severe is CVE-2026-116333?
- Medium severity, with a CVSS score of 6.5, published 12 November 2026.
- Which products and versions are affected?
- PostgreSQL 17.0 to 17.11; 18.0 to 18.6.
- Is there a fix for CVE-2026-116333?
- Yes: fixed in PostgreSQL 17.12, 18.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116333 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-116333?
- Check whether you run PostgreSQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: PostgreSQL 17.12, 18.7
Technical details
A buffer over-read in PostgreSQL's parallel B-tree scan implementation occurs when functions incorrectly marked as PARALLEL SAFE or STABLE cause participating worker processes to build different scan-key arrays, leading to out-of-bounds memory reads. The attack requires authentication and object creation privileges. The vulnerability allows an attacker to read server memory at attacker-chosen addresses, potentially leaking sensitive data such as credentials or encryption keys.
Affected products
- PostgreSQL PostgreSQL 17.0 to 17.11; 18.0 to 18.6
Timeline
- 2026-11-12: advisory