CVE-2026-14669: PostgreSQL to_char Heap Buffer Overflow Enables RCE; Public PoC, Patch Immediately

PostgreSQL disclosed high-severity heap buffer overflow CVE-2026-14669, CVSS 8.8. An authenticated database user can trigger heap overflow via the to_char() timezone-abbreviation path and execute arbitrary code as the PostgreSQL backend. Full PoC is on GitHub. All instances older than 14.24, 15.19, 16.15, 17.11, and 18.5 are at risk.

The PostgreSQL Global Development Group shipped a security update on 13 August 2026 for heap buffer overflow CVE-2026-14669. CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw sits in built-in to_char() date/time formatting. An authenticated database user can trigger it remotely and run arbitrary code in the PostgreSQL OS-account context. Full PoC is public on GitHub. Exploit bar is low. Every instance on an affected branch is at immediate risk.

Incident Overview

CVE-2026-14669 is CWE-122 (Heap-based Buffer Overflow). It hits PostgreSQL 14, 15, 16, 17, and 18. In the 13 August 2026 release cycle, the PostgreSQL Global Development Group fixed this and several overflow issues in 18.5, 17.11, 16.15, 15.19, and 14.24. PostgreSQL backs web apps, e-commerce, ERP, and finance. Blast radius is global.

Technical Details

Root cause is datetime_to_char_body() in date/time formatting. The function allocates a work buffer from the format string. On the TZ and TZtz timezone paths it copies a user-controlled POSIX timezone abbreviation into that buffer without adequate bounds checks. Authenticated connection plus an oversized timezone abbreviation triggers heap overflow.

Successful exploit runs arbitrary code as the PostgreSQL backend — equivalent to access to every database on the instance. Public PoC shows the heap overflow converted to full RCE. The official security advisory confirms code-execution exploit reports. Trigger requires database authentication. High-risk paths: internet-facing instances (listen 5432), weak-password accounts, and connections obtained via SQL injection.

Impact Assessment

CVSS: 8.8 (High). Attack vector: network. Attack complexity: low. Privileges required: low (authenticated user). User interaction: none. PoC public: yes (full exploit on GitHub). Known in-the-wild 0day: none observed for this CVE. Public PoC drops the exploit bar. Scope: all PostgreSQL older than 18.5, 17.11, 16.15, 15.19, 14.24 — production databases, web backends, cloud-hosted instances.

Affected Scope and Versions

• PostgreSQL: all versions before 18.5, 17.11, 16.15, 15.19, 14.24
• Trigger: authenticated user can call to_char() and control the timezone abbreviation
• Official fixes: PostgreSQL 18.5, 17.11, 16.15, 15.19, 14.24

Remediation

• Upgrade immediately to the patched release on your branch; prioritize internet-facing instances
• Before the upgrade window: force strong passwords, enable certificate authentication, disable weak and default accounts
• Firewall or network policy: restrict 5432 to the application tier; block direct internet connections
• Audit logs: watch anomalous to_char() call patterns and oversized timezone strings; pair with EDR and SIEM
• Least-privilege accounts that can invoke to_char(); do not over-grant function execute to application accounts
• If you cannot patch immediately: whitelist to_char() input length at the SQL audit layer. This does not replace the patch.

Detection

• PostgreSQL logs: crashed backends in pg_log, oversized timezone abbreviation strings, consecutive crash events
• WAF/IPS: detect oversized timezone strings embedded in SQL injection paths
• EDR: PostgreSQL process spawning unexpected children (shell, curl, wget, powershell)
• Host: suspicious writes under the data directory and C library load paths

PostgreSQL is among the most widely deployed open-source RDBMSs. CVE-2026-14669 is not just RCE — it shows that one missed buffer bound in core data infrastructure is an attacker entry. Inventory PostgreSQL versions now, map them to affected branches, and plan upgrades. Recheck account privileges, network exposure, and audit logs before the patch window so you do not get owned in the gap.

References

• Centre for Cyber Security Belgium: PostgreSQL remote code execution advisory
• Anheng Threat Intelligence Center: PostgreSQL CVE-2026-14669 heap overflow analysis
• PostgreSQL official security announcement