PostgreSQL Fixes 52 Flaws, Including RCE Bug CVE-2026-6460

The PostgreSQL Global Development Group has shipped security updates that address 52 vulnerabilities. The most serious, CVE-2026-6460, is a type confusion bug in composite types that lets a user who can create objects in a database run code with the privileges of the operating-system account running PostgreSQL.

According to researcher Mehmet Ince, who published a technical write-up on exploiting it, the root cause goes back to the column type-change feature added in 2004. No attacks exploiting the flaw have been reported so far.

Other fixes in the release

• CVE-2026-116322: lets an unauthenticated client restart PostgreSQL 18 servers.
• Client-tool flaws: a crafted archive can make pg_restore execute code, and a compromised source server can make psql run code through a pg_dump restore script.

How to update

1. Upgrade to 18.7, 17.12, 16.16, 15.20 or 14.25, depending on your major version.
2. Rebuild or update every C-language extension at the same time.
3. Update client tools such as pg_dump and pg_restore on every machine that uses them.
4. Follow the reindexing steps in the release announcement, and take a fresh full backup if you rely on incremental backups.

Note also that version 14 has reached end of life, and 14.25 is its final update.