Security Researcher Uncovers 22-Year-Old PostgreSQL Core Vulnerability Using AI

A researcher known online as Mehmet has detailed the discovery of a long-standing vulnerability rooted in the PostgreSQL core codebase. The security flaw stems from how the database management system handles data types and internal representations using generic carriers known as Datums, which lack self-describing type labels and instead rely on external catalog references.

The investigation began after the researcher was working on exploiting memory-corruption issues in the pg_clickhouse extension, which required translating data formats between systems. Seeking to understand how PostgreSQL processes and identifies its own data types, the researcher collaborated extensively with an AI agent to study database internals, parse trees, and object identifiers.

By manipulating a value inside a composite type and subsequently altering the type of one of its fields before reading it back, the researcher successfully induced a type-confusion bug. This quirk enabled a highly reliable remote memory-corruption execution primitive that had persisted within the core database software for over two decades.

What to watch next: Monitor for official PostgreSQL security patches or advisories addressing the newly disclosed type-confusion vulnerability and its implications for managed database environments.