CVE-2026-14669

⚠️ high

Summary

Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS Score

8.8

High

EPSS Score

0.6

Exploit Probability

Published Date

2026-08-13

First Seen: 2026-08-14

📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 80.8% of all 349,476 vulnerabilities in our database.

#67,059

Top 25% most severe

Severity Percentile

🎯 CISA SSVC Assessment Updated: Aug 13, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

🏆 Discovered By

The PostgreSQL project thanks Hcamael, Amjad Shahzad, Tomer Fichman, Zheng Yu, Amy Burnett (OpenAI Codex Security), Rick de Jager, Heewon Song, Sylvie Mayer, Aleksander Alekseev, and Hillai Ben Sasson for reporting this problem.

SSVC data provided by CISA

Last Modified 2026-08-19

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-122

📦 Affected Products 5

Vendor	Product	Status	Affected Versions
postgresql	postgresql	Affected	> 14.0 < 14.24
postgresql	postgresql	Affected	> 15.0 < 15.19
postgresql	postgresql	Affected	> 16.0 < 16.15
postgresql	postgresql	Affected	> 17.0 < 17.11
postgresql	postgresql	Affected	> 18.0 < 18.5

🔗 References 1

https://www.postgresql.org/support/security/CVE-2026...

Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-14662	⚠️ high	8.8	0.5	Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause ...	2026-08-13
CVE-2026-14663	🔶 medium	6.5	0.1	Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of ...	2026-08-13
CVE-2026-14664	⚠️ high	8.8	0.4	Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user...	2026-08-13
CVE-2026-14666	🔶 medium	4.2	0.2	Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query ...	2026-08-13
CVE-2026-14668	⚠️ high	8.1	0.3	Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a cal...	2026-08-13
CVE-2026-14670	⚠️ high	8.8	0.4	Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as t...	2026-08-13

These CVEs affect the same products