PostgreSQL’s November 9, 2026 security release fixes 52 flaws, including CVE-2026-6460, a serious type-confusion vulnerability that can enable code execution with the operating-system privileges of the PostgreSQL process.

Researcher Mehmet Ince found the flaw while investigating memory-corruption bugs in PostgreSQL extensions, and reported related vulnerabilities affecting managed PostgreSQL services.

The core issue is that a PostgreSQL Datum stores value bits without an intrinsic type label, so the server relies on type metadata to decide how to interpret those bits.

Ince found that a prepared query could retain a composite value created under an earlier field type; changing that field from UUID to bytea before running the query made PostgreSQL interpret the old UUID bytes as a bytea pointer, causing a crash.

He reproduced the crash on PostgreSQL 17.11 with a login role that had no privileges, while fixed version 17.12 rejected the query because the row type had changed after the value was created.

The exact privileges needed to move from triggering a crash to executing code remain unclear: Ince reported triggering a crash with a lowest-privileged login, while the project and Red Hat say an attacker must be able to create or modify objects.

The research describes how crafted UUID bytes could resemble an expanded-object structure, leading PostgreSQL to follow a pointer to a methods table containing native function pointers; the writeup demonstrates a crash and memory-address leak but does not include the final command-execution SQL.

Ince identified 21 related cases, and six of the 52 CVEs in the release were connected to his research; the article describes CVE-2026-6460 as the umbrella fix and says 17 other researchers reported overlapping issues.

Ince said he privately shared proof-of-concept work with AWS, Microsoft, Google, Supabase, Databricks and Ubicloud in August, but the article does not report the services’ current patch status.

Administrators should install the fixed release for their PostgreSQL major version and check with managed-service providers about upgrade status; the article lists fixes for PostgreSQL 18 and versions 17.12, 16.12 and 15.16, while PostgreSQL 14.25 is the final release for the now end-of-life version 14.

Administrators should also rebuild or update all C-language extensions, since extensions compiled against older releases may remain vulnerable; some may require source changes and may not load on older servers.

The guidance also calls for updating PostgreSQL client tools wherever they run, restarting servers managed outside the package’s service unit, keeping the new type-mismatch checks enabled, following the release’s reindexing guidance and taking a new full backup if using incremental backups.