DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-14669: CVE-2026-14669: PostgreSQL to_char() Timezone Abbreviation Heap-Based Buffer Overflow

#security #cve #cybersecurity

CVE-2026-14669: PostgreSQL to_char() Timezone Abbreviation Heap-Based Buffer Overflow

Vulnerability ID: CVE-2026-14669
CVSS Score: 8.8
Published: 2026-08-13

CVE-2026-14669 is a critical heap-based buffer overflow vulnerability in PostgreSQL's date/time formatting function to_char(timestamptz). The flaw arises from unsafe copying of user-controlled timezone abbreviations into a fixed-size internal buffer. An authenticated database user can trigger this issue by setting a long POSIX timezone abbreviation containing custom formatting, allowing them to overwrite adjacent heap structures and hijack execution control to achieve remote code execution (RCE) with the privileges of the 'postgres' operating system user.

TL;DR

An authenticated PostgreSQL user can trigger a heap-based buffer overflow in the to_char() formatting subsystem by using a maliciously long POSIX timezone abbreviation, leading to arbitrary code execution as the 'postgres' user.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-122
  • Attack Vector: Network
  • CVSS Score: 8.8
  • EPSS Score: 0.00609
  • Impact: Remote Code Execution
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • PostgreSQL Database Server
  • PostgreSQL: >= 18.0, < 18.5 (Fixed in: 18.5)
  • PostgreSQL: >= 17.0, < 17.11 (Fixed in: 17.11)
  • PostgreSQL: >= 16.0, < 16.15 (Fixed in: 16.15)
  • PostgreSQL: >= 15.0, < 15.19 (Fixed in: 15.19)
  • PostgreSQL: >= 14.0, < 14.24 (Fixed in: 14.24)

Code Analysis

Commit: 3d724bf

Guard against overlength time zone abbreviations in to_char().

Exploit Details

  • GitHub: Functional Python exploitation script leveraging dynamic heap layout modification to bypass ASLR and gain shell access.

Mitigation Strategies

  • Apply the official PostgreSQL minor version security updates immediately.
  • Restrict database access to verified, authenticated client addresses only.
  • Configure SIEM detection rules to identify anomalously long timezone parameters in SQL traffic.

Remediation Steps:

  1. Identify all deployed PostgreSQL server instances and determine active version numbers.
  2. Download the verified package or compile from source the appropriate patched release (e.g., 18.5, 17.11, 16.15, 15.19, or 14.24).
  3. Test database performance and schema compatibility in a non-production staging environment.
  4. Apply the database software update during a scheduled maintenance window, ensuring database restart.
  5. Verify the configuration by attempting to execute a long timezone setting, ensuring it is rejected with a range error.

References

Read the full report for CVE-2026-14669 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)