Researcher turns old PostgreSQL type confusion into RCE
Original title: 22-Year-Old PostgreSQL Bug Turned into Remote Code Execution
Changing a composite-type field and reading it back produced a reliable memory-corruption primitive, the author says.
Mehmet Ince describes finding a type-confusion issue in PostgreSQL core after exploiting memory bugs in extensions, including pg_clickhouse. He says giving a composite value, changing one field’s type, and reading it back yielded reliable memory corruption and remote code execution. The post is part three of a series on managed PostgreSQL risk; affected versions and a core fix are not stated in the excerpt.
Unconfirmed: The excerpt does not state affected versions, a core patch, or attacker use.
- The author calls the core issue a 22-year-old zero-day.
- The URL identifies the issue as CVE-2026-6460.
- A pg_clickhouse out-of-bounds chain was fixed on June 23.
- He used an AI agent he named pg_expert to study Datum and OID handling.
Impact: memory corruption and remote code execution
| Product | Affected |
|---|---|
| PostgreSQL | — |
From the original article
14 min read at mehmetince.net
If you had told me in April 2026 one question “Mehmet, can we use managed PostgreSQL for this project?” would send me into the deepest rabbit hole of my life, I would have laughed. Months later, I finally found the bottom of that rabbit hole.
By ozirus · mehmetince.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.