Security researcher Mehmet Ince wrote on his blog on 12 November that he found a 22-year-old flaw in the core of PostgreSQL, the open-source database. The post is part three of a series on risks in managed PostgreSQL services. Its title says he turned the flaw into remote code execution and names it CVE-2026-6460. He calls it a type confusion: the database treats stored data as one kind of value when it is another.
Ince says he made a custom row type with one UUID field, prepared a query, then changed that field to bytea, a binary data type, before running it. PostgreSQL kept the old bytes but read them as the new type. He says bytes starting with 01 make it follow a memory pointer, and his pointer was zero, so his session crashed. He says the lowest-privileged login role can trigger this on any PostgreSQL instance, and probably on Postgres-compatible products. The excerpt does not list affected versions, a fix, or the steps from crash to code execution.
Ince says the trigger needs only an ordinary login role, not an administrator account. For teams that run PostgreSQL or buy it as a managed service, that is the detail to check against the project's own advisory for CVE-2026-6460.