Part 3/6 | How I Ended Up Turning a 22-Year-Old PostgreSQL Type-Confusion Primitive into RCE (CVE-2026-6460)
Summary
This post details a 22-year-old PostgreSQL type-confusion primitive that enables remote code execution (CVE-2026-6460) via crafted composite types and bytea/detoasting exploits. It explains the internal Datum representation, how type information is determined by pg_type, and how a forged ExpandedObjectHeader can hijack control flow. The article also discusses how managed PostgreSQL providers coordinated patches and lists related CVEs.