Researcher Turns 22-Year-Old PostgreSQL Type Confusion Into RCE, CVE-2026-6460

Mehmet Ince disclosed a PostgreSQL core vulnerability after months of work following an earlier extension bug in pg_clickhouse. He described the issue as a 22-year-old zero-day in PostgreSQL core and linked it to CVE-2026-6460. The primitive involved placing a value inside a composite type, changing the type of one field, then reading the value back. Ince said the resulting type confusion produced a reliable memory-corruption path that could be turned into remote code execution.

The evidence comes from Ince’s disclosure, which walks through PostgreSQL’s internal type handling. He said he used an AI assistant, Opus 5, to study type internals, then used debug_print_parse to inspect a SELECT 1337 query tree and traced fields such as consttype 23, constlen 4, constbyval true, and constisnull false. He said the integer 1337 appeared as little-endian bytes in the constant payload. The path to the core bug began while exploiting pg_clickhouse, where ClickHouse values are converted into PostgreSQL Datum values, and the vendor fixed that extension issue.

The disclosure frames the finding as part of a broader audit of managed PostgreSQL and extension ecosystems. It shows how a conversion boundary can become a memory-safety problem: extensions must rebuild external values into PostgreSQL’s Datum format, while core type metadata tells the database how to interpret those bytes. If a composite field’s declared type and stored representation diverge, PostgreSQL may read memory through the wrong lens. The 22-year-old age points to long-lived internal assumptions in core code rather than a newly introduced regression.

The finding matters because PostgreSQL is a foundational database used directly and through managed cloud services, and extensions sit inside the same process as the core. Ince’s account says the flaw was reachable through type handling, not only through an extension bug, and that it produced a reliable memory-corruption exploit. The disclosure does not include a vendor advisory in the excerpt, so the exact affected versions, exploit conditions, and patch status remain limited to the researcher’s description and the CVE identifier in the URL.