Threats tagged 'ghsa-mg59-w58g-jwm6'

A use-after-free vulnerability exists in PostgreSQL's handling of anonymous RECORD type identifiers among parallel workers. This flaw allows a database user to execute arbitrary code with the privileges of the operating system user running the database. The issue arises when one process frees a shared tuple descriptor while another process still retains and later uses its address. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.