A 22-Year-Old PostgreSQL Bug Let a Researcher Achieve Remote Code Execution
22-Year-Old PostgreSQL Bug Turned into Remote Code Execution
While exploiting a PostgreSQL extension, security researcher Mehmet Ince wondered how PostgreSQL decides what a value is. That question led him to a type-confusion flaw in PostgreSQL core that had gone unnoticed for 22 years. By giving PostgreSQL a value inside a composite type, changing the type of one of its fields, and asking it to read the value back, he built one of the most reliable memory-corruption exploits he has seen, tracked as CVE-2026-6460.
I gave PostgreSQL a value inside a composite type, changed the type of one of its fields, and asked it to read the value back. That type confusion led to one of the most reliable memory-corruption exploit I have seen.