CVE-2026-6474·PostgreSQL vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.31% — higher than 22% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

Upgrade PostgreSQL to version 18.4 or later to patch a format string vulnerability in the timeofday() function that could leak sensitive server memory. This vulnerability requires authenticated database access to exploit, so immediate patching is recommended for systems with untrusted database users.

sudo dnf update postgresql-server postgresql-contrib postgresql-libs

How to check if you are affected

1. Step 1: Check your PostgreSQL version by running `psql --version` or connecting to the database and executing `SELECT version();`
2. Step 2: Identify users with database connection privileges by querying `SELECT usename, usecanlogin FROM pg_user;` to understand your attack surface
3. Step 3: Search PostgreSQL logs (typically in /var/log/postgresql/) for calls to the timeofday() function combined with unusual timezone parameters using `grep -i 'timeofday' /var/log/postgresql/*.log`
4. Step 4: After upgrading, verify the new version with `psql --version` and confirm the fix by checking that FORMAT strings in timezone handling no longer trigger memory disclosure

FAQ

Related PostgreSQL CVEs

References

• https://www.postgresql.org/support/security/CVE-2026-6474/