CVE-2026-14669

A heap buffer overflow flaw was found in the PostgreSQL to_char(timestamptz) function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise.

A heap buffer overflow in PostgreSQL's to_char(timestamptz) function allows an attacker to execute arbitrary code as the database system user by supplying a long POSIX timezone abbreviation. This risk is highest where untrusted users can modify timezone settings.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce the risk of exploitation, ensure that only trusted users have privileges to modify timezone settings within the PostgreSQL database. Additionally, restrict network access to the PostgreSQL server to only trusted clients and applications through firewall rules, limiting the attack surface for remote exploitation.