PostgreSQL patches 52 flaws, including 22-year-old remote code execution bug

PostgreSQL updates reportedly address CVE-2026-6460, a type-confusion flaw rated CVSS 8.8, alongside 51 other security issues. The reported attack requires an authenticated database account that can create objects. Servers with C-language extensions may also need those extensions rebuilt after patching.[1]PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCEthehackernews.com · rssOpen original sourceSee in source list

Researcher Mehmet Ince described using prepared statements and a change to a composite type to make PostgreSQL interpret an existing binary value as a different data type. A subsequent report says this behavior was developed into memory-reading and memory-writing capabilities and ultimately arbitrary code execution on PostgreSQL 18.6.[2]prepared statements prevents SQLi. But it also helped me to exploit a 22 years old PostgreSQL 0-day RCE (CVE-2026-6460)mehmetince.net · rssOpen original sourceSee in source list[3]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list

If successfully exploited, the flaw could let a limited database user cross the boundary between SQL permissions and the underlying server, running code with the privileges of the PostgreSQL operating-system account. The reported consequences include access to other users' data, server files and secrets.[3]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list[1]PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCEthehackernews.com · rssOpen original sourceSee in source list

Administrators should apply the PostgreSQL security updates, inventory installed C-language extensions and rebuild those extensions where required. They should also review accounts and roles that can create database objects, because that capability is described as the prerequisite for exploitation rather than superuser access.[1]PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCEthehackernews.com · rssOpen original sourceSee in source list[3]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list

The supplied evidence consistently identifies CVE-2026-6460, a CVSS score of 8.8 and object-creation privileges as the reported attack conditions. It does not establish whether the flaw has been exploited in the wild, list every affected or fixed PostgreSQL release, or identify which deployed extensions specifically require rebuilding.[4]postgresql.orgpostgresql.org · rssOpen original sourceSee in source list[1]PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCEthehackernews.com · rssOpen original sourceSee in source list[3]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list

The Hacker News says patching alone may not provide full protection because installed C-language extensions must also be rebuilt. The ptdbugs account says Ince demonstrated arbitrary code execution on PostgreSQL 18.6 without needing database superuser privileges.[1]PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCEthehackernews.com · rssOpen original sourceSee in source list[3]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list

The supplied timeline begins with Ince's technical post about turning the bug into remote code execution. Later entries point to the PostgreSQL CVE page and coverage of the security release, shifting the story from exploit research to remediation and operational exposure.[2]prepared statements prevents SQLi. But it also helped me to exploit a 22 years old PostgreSQL 0-day RCE (CVE-2026-6460)mehmetince.net · rssOpen original sourceSee in source list[4]postgresql.orgpostgresql.org · rssOpen original sourceSee in source list[1]PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCEthehackernews.com · rssOpen original sourceSee in source list

4 independent groups, 4 updates, and 14 engagements. Observed communities: r/netsec.

The reported proof of concept creates a composite type containing a UUID field and prepares a query that uses it. The field is then changed to bytea before the prepared query is executed. PostgreSQL allegedly retains the old binary representation while processing it under the new type, causing pointer misinterpretation and memory corruption. The researcher reportedly added address disclosure to bypass ASLR, the operating system defense that randomizes memory locations.[3]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list[2]prepared statements prevents SQLi. But it also helped me to exploit a 22 years old PostgreSQL 0-day RCE (CVE-2026-6460)mehmetince.net · rssOpen original sourceSee in source list

The evidence lot contains an official PostgreSQL CVE page and Ince's research post, but their supplied RSS records include no article body. Their URLs and titles establish the presence and subject of those primary artifacts, not all of the detailed claims attributed to them elsewhere.[4]postgresql.orgpostgresql.org · rssOpen original sourceSee in source list[2]prepared statements prevents SQLi. But it also helped me to exploit a 22 years old PostgreSQL 0-day RCE (CVE-2026-6460)mehmetince.net · rssOpen original sourceSee in source list

Within this lot, the remediation details come mainly from The Hacker News excerpt, while the detailed exploit sequence, affected-version demonstration and claimed impact come from the ptdbugs post. Those technical assertions should therefore remain attributed rather than treated as independently verified reproduction results.[1]PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCEthehackernews.com · rssOpen original sourceSee in source list[3]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list