22-Year-Old PostgreSQL Bug Turned into Remote Code Execution

A researcher discovered a 22-year-old zero-day vulnerability in PostgreSQL's core (CVE-2026-6460) that enables remote code execution through a type-confusion attack. The exploit works by inserting a value into a composite type, changing the type of one of its fields, and then reading the value back, resulting in reliable memory corruption. The vulnerability was uncovered while investigating security issues in managed PostgreSQL services and PostgreSQL extensions.