# CVE-2026-96883: Type confusion in AWS pgcollection allows remote code execution

> CVE-2026-96883: Type confusion in AWS pgcollection allows remote code execution. CVSS 8.8 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-96883
Last updated: 2026-09-25T13:16:34Z

- Published: 2026-09-24 19:05 UTC · Updated: 2026-09-25 13:16 UTC · Assigner: AMZN
- CVSS: 8.8 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS: 0.65%, 51th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-843

## Description

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in collection value retrieval and array conversion functions. To remediate this issue, users should upgrade to version 2.1.2 or later.

## Affected vendors and products

- AWS: pgcollection

## Tracked companies

- [Amazon Web Services](https://rewindex.com/company/aws.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-96883)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-96883)
- [https://aws.amazon.com/security/security-bulletins/2026-118-aws/](https://aws.amazon.com/security/security-bulletins/2026-118-aws/)
- [https://github.com/aws/pgcollection/releases/tag/v2.1.2](https://github.com/aws/pgcollection/releases/tag/v2.1.2)
- [https://github.com/aws/pgcollection/security/advisories/GHSA-g539-cj32-hv6r](https://github.com/aws/pgcollection/security/advisories/GHSA-g539-cj32-hv6r)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-96883 · Markdown: https://rewindex.com/cve/CVE-2026-96883.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-96883 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:13:08.336Z