HighPublic exploitVulnerability

CVE-2026-14669

Arbitrary Code Execution in PostgreSQL to_char(timestamptz)

Published Aug 13, 2026 · Updated 4 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

8 mentions · peak 2 in a dayToday

CVSS8.8High · v3.1

EPSS0.66%52nd percentile

CISA KEVNoNot listed

In the wildNonePublic exploit, no exploitation reported

Vendor: Postgresql

IdentifiersCVE-2026-14669CWE-122 · Heap-based Buffer Overflow

CVE-2026-14669 is a heap-based buffer overflow in PostgreSQL's to_char(timestamptz) function when processing a long POSIX timezone abbreviation. A party able to choose the timezone can trigger memory corruption and execute arbitrary code as the operating system account running the database server. Affected releases precede PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 within their respective major-version branches.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation compromises the PostgreSQL server process with the privileges of its operating system account, potentially allowing disclosure or modification of database data, access to other resources available to that account, and disruption of database availability. The vulnerability is rated CVSS 3.1 8.8, with high confidentiality, integrity, and availability impacts. It does not inherently grant operating system root privileges.

Mitigation

If you can’t patch tonight, do this now.

Until patching is complete, restrict untrusted database users and application inputs from controlling timezone values that reach to_char(timestamptz). Limit database network access to trusted clients and enforce least-privilege database roles. These measures reduce exposure but do not replace the security update.

Remediation

Patch, then assume compromise.

Upgrade to PostgreSQL 18.6, 17.11, 16.15, 15.19, or 14.24 or later within the corresponding release branch, or install the distribution's security-fixed PostgreSQL packages. Migrate older unsupported releases to a supported, patched version. Restart PostgreSQL after package updates so the patched server binaries take effect.

Public exploits

Exploits

1 exploit validated by Mallory's analysis.

View more in app →

CVE-2026-14669This repository is a compact authenticated RCE proof-of-concept for CVE-2026-14669 in PostgreSQL's timezone formatting path used by `to_char(timestamptz)`. It contains one primary exploit script (`poc.py`), a Docker lab definition (`docker-compose.yml`), dependency file (`requirements.txt`), and documentation (`README.md`). The exploit is real code, not just detection logic. The Python PoC uses `psycopg` and `pwntools` to speak to PostgreSQL over its normal wire protocol. Its structure is staged: `connect()` establishes a DB session; `leaker()` abuses oversized timezone data and binary `COPY` output from `to_char(now(),'TZ')` to corrupt a varlena length and leak adjacent heap contents, from which it derives the PostgreSQL PIE base using known handler-pointer offsets; `heap_leak()` triggers `to_char(now(),'TZtz')` and parses an `invalid pointer` error message to recover a live heap address; `shaper2()` performs heap shaping and crafts fake memory-context callback structures so that `MemoryContextReset()` eventually calls `system()` with the attacker-controlled command. The default command is `echo PWNED; id`, demonstrating code execution as the postgres service account. The exploit is operational but not broadly portable: it is hardcoded for a specific PostgreSQL 19beta1 official build and image digest, with fixed offsets such as `SYSTEM_PLT`, `RVA_HASH`, `RVA_CMP`, and `ASET_METHODS`. The README claims broader affected versions (14.x through 18.x ranges), but the actual code is tuned to one build and would require retargeting for others. The included Docker Compose file creates a local lab container named `pg-tzlab`, disables autovacuum for heap-grooming stability, and binds PostgreSQL to `127.0.0.1:55432`. Primary exploit capability: authenticated network-based remote code execution against a vulnerable PostgreSQL server, assuming valid credentials and SQL execution ability. Secondary capabilities include memory disclosure of PIE and heap addresses, ASLR bypass assistance, heap grooming, and backend crash/exit during exploitation.HackSpeak · Disclosed Aug 18, 2026 · python · yaml · network · localOperational

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

PostgresqlPostgresqlapplication

External references

References

MITRE CVEcve.org · CVE-2026-14669 NVDnvd.nist.gov/vuln/detail/CVE-2026-14669 MITRE CWE · CWE-122Heap-based Buffer Overflow Vendor Advisorypostgresql.org/support/security/CVE-2026-14669

Activity feed

Recent activity

89 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

tenable nessus pluginsNews · Nov 2, 2026Photon OS 5.0: Postgresql16 PHSA-2026-5.0-90-1039 | Tenable®A vulnerability covered by the PhotonOS PostgreSQL 16 security check; its technical nature and individual exploitation status are not specified.Read more ↗tenable nessus pluginsNews · Nov 2, 2026Photon OS 5.0: Postgresql15 PHSA-2026-5.0-90-1039 | Tenable®Listed in the Photon OS 5.0 PostgreSQL 15 security check. No vulnerability-specific technical details or exploit-availability attribution are provided.Read more ↗tenable cloud security pluginsNews · Oct 28, 2026Chainguard: libecpg-14, multiple postgresql-14 packages: secur... | Tenable®A heap buffer overflow in PostgreSQL's to_char(timestamptz) permits a party controlling the timezone to execute arbitrary code with the database service's operating-system privileges using a long POSIX timezone abbreviation. Affected versions are those before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24. The advisory assigns a CVSS v3 base score of 8.8 and reports that exploits are available.Read more ↗tenable nessus pluginsNews · Oct 27, 2026TencentOS Server 3: postgresql:12 (TSSA-2026:1218) | Tenable®An attacker controlling the timezone can supply a long POSIX timezone abbreviation to trigger a heap buffer overflow in to_char(timestamptz), allowing code execution as the database server account. Package updates are available.Read more ↗

+70 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity10Community discussion across Reddit, Mastodon, and other social sources.