22-Year-Old PostgreSQL Type Confusion Flaw Exploited for Remote Code Execution

The article describes discovery of a 22-year-old type confusion vulnerability in PostgreSQL core (CVE-2026-6460) that enables reliable memory corruption and remote code execution. The researcher found it while investigating pg_clickhouse, an extension that translates ClickHouse values into PostgreSQL format. After exploiting a memory corruption bug in pg_clickhouse, the researcher studied how PostgreSQL handles types internally, discovering that Datums are 8-byte value containers that carry no type information themselves—instead, an OID (Object Identifier) points to type metadata in the pg_type system catalog that determines how the value is interpreted.

The vulnerability arises from PostgreSQL trusting type metadata without validating actual data. By storing a value in a composite type, changing one field’s type definition, then reading the value back, PostgreSQL reinterprets the same bytes according to the new type’s metadata. Since type conversion functions trust the OID context rather than the underlying data structure, this creates exploitable memory corruption. The same 8-byte Datum can represent integers, text, arrays, or custom types based purely on its associated OID, enabling the type confusion attack.