The PostgreSQL Global Development Group has released security updates addressing 52 vulnerabilities across its database platform, including a high-severity type confusion flaw that could allow a database user with object-creation privileges to execute arbitrary code on the server. Tracked as CVE-2026-6460, the vulnerability carries a CVSS score of 8.8 and affects PostgreSQL versions before 18.7, 17.12, 16.16, 15.20 and 14.25. The updates were announced on 12 November 2026 and also include fixes for more than 140 reported bugs. According to the project’s official security advisory, successful exploitation could allow code to run with the operating system privileges of the account running the PostgreSQL database service. The issue involves inadequate tracking of typed values within the database system, allowing older values to be interpreted using an updated data type. The advisory identifies users able to create objects as the relevant attacker category, making the vulnerability particularly important for administrators managing database permissions and access across shared environments.
The flaw is associated with PostgreSQL composite types, which consist of multiple named fields, each assigned its own data type. Problems can arise when a field’s type changes while older values remain stored elsewhere in the database system. In such circumstances, the server may interpret an existing value according to the updated type rather than its original structure, potentially leading to memory corruption and code execution. The PostgreSQL fix introduces additional version tracking for composite types and checks that values match their expected definitions before processing them. The project’s release notes describe the changes included in the updated versions. Security researcher Mehmet Ince also published a technical analysis explaining how he developed an exploit demonstration using PostgreSQL 18.6. His research describes how a prepared query can retain a value while the type of one of its fields is changed, allowing the database to process the stored value incorrectly. The writeup documents stages of the research, including a server crash and memory-address disclosure, as well as the development of a code-execution technique. These findings provide technical context for the vulnerability, while the official PostgreSQL advisory remains the primary reference for its affected versions and security impact.
The November security release addresses a wider collection of issues involving the PostgreSQL server and its client utilities. Among the additional vulnerabilities listed by the project are CVE-2026-6467, involving extension-script schema handling; CVE-2026-14661, affecting file-writing behaviour involving dblink and subscriptions; and CVE-2026-116304, involving a parallel RECORD typmod use-after-free issue. Several of the reported vulnerabilities carry CVSS scores of 8.8. The release also includes fixes affecting tools used for database administration and backups. For example, CVE-2026-116314 addresses a pg_restore issue involving crafted archives that could lead to arbitrary code execution, while CVE-2026-116330 concerns command injection through pg_dump tar output. Administrators should therefore consider the broader release rather than treating CVE-2026-6460 as the only issue requiring attention. The project’s security index provides further information about the vulnerabilities, their severity ratings and the versions in which they have been fixed. PostgreSQL 14.25 is also the final release for the PostgreSQL 14 series, which has now reached end-of-life and will no longer receive routine security or bug fixes. Organisations still operating that version are advised by the project to plan a move to a supported major release.
Administrators are advised to update PostgreSQL installations to the fixed minor versions corresponding to their existing major releases: 18.7, 17.12, 16.16, 15.20 or 14.25. The update requires additional attention for installations using C-language extensions. A PostgreSQL packaging maintainer has explained that older extensions may continue loading after the server update but might not include the checks introduced by the security fix. The maintainer recommends rebuilding or updating the extensions alongside the server, with both components brought to matching versions. Administrators using PostgreSQL through custom service configurations or tools such as Patroni should also ensure the database process is restarted after updating. The project recommends reviewing the release notes for additional maintenance steps, including reindexing where applicable and creating a new full backup after updating if incremental backups are in use. Client utilities, including pg_dump and pg_restore, should also be updated on systems where they are installed and used. The project has not provided a workaround for installations that cannot apply the updates, and it advises against disabling the new composite-type checks through the relevant configuration setting.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
