UBUNTU-CVE-2026-6474

Details

Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Affected Packages

postgresql-12

Ubuntu 20.04 LTS

Affected versions:

12.0-112.1-112.1-2build112.10-0ubuntu0.20.04.112.11-0ubuntu0.20.04.112.12-0ubuntu0.20.04.112.13-0ubuntu0.20.04.112.14-0ubuntu0.20.04.112.15-0ubuntu0.20.04.112.16-0ubuntu0.20.04.1+16 more

postgresql-14

Ubuntu 22.04 LTS

Fixed in:

14.23-0ubuntu0.22.04.1

postgresql-16

Ubuntu 24.04 LTS

Fixed in:

16.14-0ubuntu0.24.04.1

postgresql-17

Ubuntu 25.10

Fixed in:

17.10-0ubuntu0.25.10.1

postgresql-18

Ubuntu 26.04 LTS

Fixed in:

18.4-0ubuntu0.26.04.1

postgresql-9.3

Ubuntu Pro 14.04 LTS

Affected versions:

9.3.1-19.3.10-0ubuntu0.14.049.3.11-0ubuntu0.14.049.3.12-0ubuntu0.14.049.3.13-0ubuntu0.14.049.3.14-0ubuntu0.14.049.3.15-0ubuntu0.14.049.3.16-0ubuntu0.14.049.3.17-0ubuntu0.14.049.3.18-0ubuntu0.14.04.1+19 more

postgresql-9.5

Ubuntu Pro 16.04 LTS

Affected versions:

9.5.0-19.5.0-29.5.0-39.5.1-19.5.10-0ubuntu0.16.049.5.11-0ubuntu0.16.049.5.12-0ubuntu0.16.049.5.13-0ubuntu0.16.049.5.14-0ubuntu0.16.049.5.16-0ubuntu0.16.04.1+24 more

postgresql-10

Ubuntu Pro 18.04 LTS

Affected versions:

10.1-110.1-210.10-0ubuntu0.18.04.110.12-0ubuntu0.18.04.110.14-0ubuntu0.18.04.110.15-0ubuntu0.18.04.110.16-0ubuntu0.18.04.110.17-0ubuntu0.18.04.110.18-0ubuntu0.18.04.110.19-0ubuntu0.18.04.1+16 more

References

REPORT

https://ubuntu.com/security/CVE-2026-6474

ADVISORY

https://ubuntu.com/security/notices/USN-8294-1

REPORT

https://www.cve.org/CVERecord?id=CVE-2026-6474

REPORT

https://www.postgresql.org/about/news/postgresql-184-1710-1614-1518-and-1423-released-3297/

REPORT

https://www.postgresql.org/support/security/CVE-2026-6474/