PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Code Execution

PostgreSQL released minor updates that fix 52 security flaws, including CVE-2026-6460, a type-confusion bug that can let a database user able to create objects run code on the server. The affected releases are all versions before 18.7, 17.12, 16.16, 15.20 and 14.25. The bug scores 8.8 on the CVSS scale and gives executed code the rights of the operating-system account running PostgreSQL. Full protection also requires rebuilding C-language extensions installed on the server.

Evidence for the flaw comes from a technical writeup by researcher Mehmet Ince, who demonstrated a working exploit on PostgreSQL 18.6. He prepared a query holding a value, changed a field type inside a composite type, and ran the query so the server read an old value under a newer type. His writeup includes SQL that crashes an unpatched server and leaks memory addresses, but not the SQL for the final command-execution step. He says the crash can be triggered by a lowest-privileged login role.

The project's advisory and Red Hat describe the attacker as someone who can create or modify objects, while the source does not confirm whether an account with only default privileges can reach code execution. Ince traces the root cause to a 2004 PostgreSQL change that allowed column-type changes and a 2015 change that enabled the exploit path. He privately shared proofs of concept with AWS, Microsoft, Google, Supabase, Databricks and Ubicloud in August, but did not publish their patch status. The release also rates 32 flaws at 8.8 and fixes one unauthenticated restart flaw, CVE-2026-116322.

The operational exposure is broad because PostgreSQL underpins enterprise applications, government systems and managed cloud databases. No attacks have been reported, and CISA lists exploitation as none, so the immediate evidence is a disclosed, not observed, campaign. The larger pattern is technical debt: a flaw born in old type-handling logic can persist for 22 years and still require administrators to patch servers and rebuild extensions. Client-tool fixes matter too: crafted archives or compromised source servers can make pg_restore and psql run code as the local user. That maintenance burden is where foundational software becomes fragile.