CVE 2026 14669

nvd.nist.gov • August 24, 2026

Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PostgreSQL Vulnerability Allows Remote Code Execution A heap-based buffer overflow vulnerability, CVE-2026-14669, has been discovered in PostgreSQL's to_char() function, affecting versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24. This vulnerability allows authenticated attackers to execute arbitrary code as the operating system user running the database by supplying an oversized POSIX timezone abbreviation. The vulnerability was published on August 13, 2026, with a proof-of-concept released on August 18, increasing the urgency for organizations to patch their systems. PostgreSQL has released fixes for all supported affected branches. The Centre for Cybersecurity Belgium recommends immediate patching and enhanced monitoring to detect potential intrusions. Organizations are advised to report any incidents promptly. Historical compromises may still exist even after patching. 1 sources 72

CVE 2026 14669

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (1)