PostgreSQL

www.postgresql.org • August 24, 2026

Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

For more information PostgreSQL versioning , please visit the versioning page .

If you wish to report a new security vulnerability in PostgreSQL, please send an email to [email protected] .

For reporting non-security bugs, please see the Report a Bug page.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PostgreSQL Vulnerability Allows Remote Code Execution A heap-based buffer overflow vulnerability, CVE-2026-14669, has been discovered in PostgreSQL's to_char() function, affecting versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24. This vulnerability allows authenticated attackers to execute arbitrary code as the operating system user running the database by supplying an oversized POSIX timezone abbreviation. The vulnerability was published on August 13, 2026, with a proof-of-concept released on August 18, increasing the urgency for organizations to patch their systems. PostgreSQL has released fixes for all supported affected branches. The Centre for Cybersecurity Belgium recommends immediate patching and enhanced monitoring to detect potential intrusions. Organizations are advised to report any incidents promptly. Historical compromises may still exist even after patching. 1 sources 72

Extracted Entities

PostgreSQL

The full story

Extracted Entities

CWE Weaknesses (1)

Domains (1)

Email Addresses (1)