PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE
A type confusion flaw in PostgreSQL lets a database user who can create objects run code on the server, and updates released yesterday fix it, along with 51 other security flaws.
A type confusion flaw in PostgreSQL lets a database user who can create objects run code on the server, and updates released yesterday fix it, along with 51 other security flaws.
Full protection from this flaw also requires rebuilding any C-language extensions installed on the server.
The PostgreSQL Global Development Group, which publishes the database's releases, has not reported any attacks using the flaw, and the server could then read an old value as if it had the new type.
Any code run this way has the rights of the operating system user that runs PostgreSQL; all versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
A field's type can be changed while older values of that type are still held in other parts of the server, and the fix, described in the project's release notes, adds version checks so the server can detect a value that no longer matches its type.
The flaw, tracked as CVE-2026-6460, has a CVSS score of 8.8, and cISA's assessment in the CVE record also lists exploitation as none.
Security researcher Mehmet Ince described a working exploit for the flaw, demonstrated on PostgreSQL 18.6, in a technical writeup published this week.
The writeup includes the SQL that crashes an unpatched server this way and a second step that leaks memory addresses.
The project credits more than a dozen reporters for CVE-2026-6460, including the researcher, and credits him on five other flaws in the same release.
What happened
A type confusion flaw in PostgreSQL lets a database user who can create objects run code on the server, and updates released yesterday fix it, along with 51 other security flaws.
Full protection from this flaw also requires rebuilding any C-language extensions installed on the server.
What changed
The PostgreSQL Global Development Group, which publishes the database's releases, has not reported any attacks using the flaw, and the server could then read an old value as if it had the new type.
Who is affected
Any code run this way has the rights of the operating system user that runs PostgreSQL; all versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Why it matters
A field's type can be changed while older values of that type are still held in other parts of the server, and the fix, described in the project's release notes, adds version checks so the server can detect a value that no longer matches its type.
Technical details
The flaw, tracked as CVE-2026-6460, has a CVSS score of 8.8, and cISA's assessment in the CVE record also lists exploitation as none.
Security researcher Mehmet Ince described a working exploit for the flaw, demonstrated on PostgreSQL 18.6, in a technical writeup published this week.
Response
The writeup includes the SQL that crashes an unpatched server this way and a second step that leaks memory addresses.
The project credits more than a dozen reporters for CVE-2026-6460, including the researcher, and credits him on five other flaws in the same release.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.