high CVSS 8.8

CVE-2026-14669·PostgreSQL vulnerability

Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity
high
Software
PostgreSQL
Fixed in
18.5
Published

Affected versions

From: 18.0

Until: 18.5

Fixed in: 18.5

How to fix this CVE

Upgrade PostgreSQL to version 18.6 or later to patch a heap buffer overflow vulnerability in the to_char(timestamptz) function that could allow authenticated attackers to execute arbitrary code. Organizations running PostgreSQL 18.0–18.5 should prioritize this update, as the flaw is triggered through manipulation of POSIX timezone abbreviations during timestamp formatting operations.

sudo dnf update postgresql-server postgresql-contrib postgresql-libs

Defensia detects this vulnerability

How to check if you are affected

  1. Check your PostgreSQL version with: psql --version or sudo -u postgres psql -c 'SELECT version();'
  2. Identify if timezone-related features are in use by checking postgresql.conf for timezone settings and reviewing application code for to_char(timestamptz) calls
  3. Search PostgreSQL logs for errors related to to_char() or timezone conversion failures: grep -i 'to_char\|timezone' /var/log/postgresql/postgresql.log
  4. After patching, verify the updated version: sudo -u postgres psql -c 'SELECT version();' and confirm it reports 18.6 or higher

FAQ

What is CVE-2026-14669?

This CVE describes a heap buffer overflow in PostgreSQL's to_char(timestamptz) function that occurs when processing excessively long POSIX timezone abbreviations, allowing authenticated database users to trigger code execution with the privileges of the PostgreSQL process owner.

Is CVE-2026-14669 being actively exploited?

No, this vulnerability is not currently listed as actively exploited in the CISA KEV catalog, and no public exploits have been disclosed. However, it should still be patched promptly given its high severity rating.

What versions of PostgreSQL are affected by CVE-2026-14669?

PostgreSQL versions 18.0 through 18.5 are vulnerable. Versions 18.6 and later contain the fix. Affected versions in other release branches include 17.x before 17.11, 16.x before 16.15, 15.x before 15.19, and 14.x before 14.24.

How do I check if my server is vulnerable to CVE-2026-14669?

Run: sudo -u postgres psql -c 'SELECT version();' If the output shows PostgreSQL 18.0–18.5, your server is vulnerable. Cross-reference with your installed package version using: dpkg -l | grep postgresql (Debian/Ubuntu) or rpm -qa | grep postgresql (RHEL/CentOS).

Does Defensia detect CVE-2026-14669?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-14669 will appear in your dashboard with remediation steps.

Related PostgreSQL CVEs

CVE-2026-14664CVSS 8.8Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14670CVSS 8.8Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-15742CVSS 8.8Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14671CVSS 8.8Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-16238CVSS 8.8Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-14669. Free for 1 server.

Get started free