PostgreSQL Fixes 52 Security Flaws, Including Decades-Old Code Execution Bug

PostgreSQL has released security updates addressing 52 vulnerabilities, including a high-severity flaw dating back 22 years that could allow an authenticated attacker to execute malicious code on a database server.

The updates cover PostgreSQL versions 18.7, 17.12, 16.16, 15.20, and 14.25. They also resolve more than 140 software bugs affecting database reliability and operations.

The most serious issue, tracked as CVE-2026-6460, carries a CVSS score of 8.8 and could allow a database user with permission to create objects to execute code with the privileges of the operating system account running PostgreSQL.

The vulnerability involves a type confusion error in how PostgreSQL handles changes to structured data types. Under certain conditions, the database can incorrectly interpret previously stored values, creating an opportunity for memory corruption and code execution.

A technical investigation demonstrated a working exploit against PostgreSQL 18.6 and traced the underlying vulnerability to a code change introduced in May 2004. The research also examined exploitation techniques affecting managed database services, including AWS, Microsoft Azure, Google AlloyDB, and Supabase.

There have been no confirmed reports of the vulnerability being exploited in real-world attacks.

The broader security release also fixes vulnerabilities affecting PostgreSQL backup and restoration tools. Some could allow malicious database content to trigger code execution, while another flaw, CVE-2026-116322, could let an unauthenticated attacker force PostgreSQL 18 servers to restart.

Updating the database server alone may not fully address the vulnerabilities. Administrators are urged to install the latest updates and rebuild C-language extensions. PostgreSQL also recommends reviewing index maintenance requirements and creating fresh full backups for installations using incremental backups.

The release also marks the end of support for PostgreSQL 14, making version 14.25 its final security update. Organizations still running that version will need to migrate to a supported release to receive future fixes.