CVE-2026-14669

Details

Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Affected Packages

PostgreSQL

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1703)Windows 10 (1709)Windows 10 (1803)

Fixed in:

14.2415.1916.1517.1118.6

postgresql@14

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@15

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@16

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@17

brew

Fixed in:

14.2415.1916.1517.1118.6

postgresql@18

brew

Fixed in:

14.2415.1916.1517.1118.6

References

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-14669

WEB

https://www.postgresql.org/support/security/CVE-2026-14669/