# CVE-2026-116333: PostgreSQL buffer over-read in parallel B-tree scans

Source: https://junglewise.ai/threats/cve-2026-116333-buffer-over-read-in-postgresql-parallel-b-tree-scans-allows-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-116333 · Severity: medium · CVSS 6.5 · Published 2026-11-12

PostgreSQL is a database server used by many organizations to store and retrieve critical data. A vulnerability in parallel B-tree scans allows an authenticated database user to read arbitrary memory addresses from the server, potentially exposing sensitive information. Exploitation requires the attacker to create functions, and does not cause service disruption or unauthorized data modification.

Technologies: [PostgreSQL](https://junglewise.ai/threats/technologies/postgresql). Vendors: [PostgreSQL](https://junglewise.ai/threats/vendors/postgresql).

## Quick answers

**Is CVE-2026-116333 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116333 being exploited in the wild.

**How severe is CVE-2026-116333?** Medium severity, with a CVSS score of 6.5, published 12 November 2026.

**Which products and versions are affected?** PostgreSQL 17.0 to 17.11; 18.0 to 18.6.

**Is there a fix for CVE-2026-116333?** Yes: fixed in PostgreSQL 17.12, 18.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116333 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-116333?** Check whether you run PostgreSQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in PostgreSQL 17.12, 18.7

## Technical details

A buffer over-read in PostgreSQL's parallel B-tree scan implementation occurs when functions incorrectly marked as PARALLEL SAFE or STABLE cause participating worker processes to build different scan-key arrays, leading to out-of-bounds memory reads. The attack requires authentication and object creation privileges. The vulnerability allows an attacker to read server memory at attacker-chosen addresses, potentially leaking sensitive data such as credentials or encryption keys.

## Affected products

- PostgreSQL PostgreSQL 17.0 to 17.11; 18.0 to 18.6

## Timeline

- 2026-11-12: advisory

## References

- [https://www.postgresql.org/support/security/CVE-2026-116333/](https://www.postgresql.org/support/security/CVE-2026-116333/)

## Related threats

- [PostgreSQL CREATE EXTENSION arbitrary SQL execution](https://junglewise.ai/threats/cve-2026-6467-uncontrolled-search-path-element-in-postgresql-create-extension)
- [PostgreSQL type confusion in ALTER allows arbitrary code execution](https://junglewise.ai/threats/cve-2026-6460-type-confusion-in-postgresql-allows-an-object-creator-to-execute)
- [PostgreSQL type confusion in SQL-language functions arbitrary code execution](https://junglewise.ai/threats/cve-2026-18447-type-confusion-in-postgresql-sql-language-functions-allows-an)
- [PostgreSQL INSERT ON CONFLICT authorization bypass on auto-updatable views](https://junglewise.ai/threats/cve-2026-16237-improper-protection-in-postgresql-insert-on-conflict-on-auto)
- [PostgreSQL dblink and subscriptions arbitrary file append](https://junglewise.ai/threats/cve-2026-14661-external-control-of-file-name-in-postgresql-dblink-and-create)