PostgreSQL CVE-2026-14669

The attacker must hold a valid PostgreSQL database credential with at minimum CONNECT privilege to a database on the target instance - this is the primary gating condition. No special database role (superuser, schema owner) is required because SET timezone and to_char() are available to any authenticated session. The triggering input is a POSIX timezone abbreviation crafted to exceed the buffer length assumed by the to_char(timestamptz) implementation; no special database configuration or non-default setting is needed beyond the ability to issue standard SQL. Exploitation is limited by: (1) requirement for authenticated database access - unauthenticated network attackers cannot reach this code path; (2) the flaw is in a specific formatting function, meaning an attacker must be able to issue SQL (direct connection or via SQL injection into an application that calls to_char). Environments using strict network ACLs to limit who can reach the PostgreSQL port and strong credential hygiene substantially reduce realistic risk despite the low CVSS attack complexity.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scores 8.8 and accurately reflects the threat model: network-reachable, low complexity, requiring only a low-privilege authenticated database session. Any user granted CONNECT privilege to a PostgreSQL instance - including application service accounts, read-only analysts, or ETL users - qualifies as a sufficient attacker. This is a meaningful real-world threat, not a theoretical high-CVSS-but-hard-to-exploit case, because the triggering primitive (SET timezone / to_char()) is part of standard SQL and requires no elevated database role. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in the CISA KEV catalog at time of analysis, meaning active exploitation has not been officially confirmed. However, the straightforward trigger mechanism and the fact that fix versions have been released suggests the vulnerability is fully characterized and a functional exploit is plausible to develop. The primary limiting factor is that the attacker must hold a valid database credential, which substantially narrows the realistic threat surface compared to a pre-authentication flaw.

An attacker with a valid low-privilege PostgreSQL database account (e.g., a compromised application service credential) connects to the database over the network, issues SET timezone to a crafted string containing an abnormally long POSIX timezone abbreviation, and then invokes to_char(now(), 'TZ') or similar to trigger the formatting code path. The heap overflow corrupts adjacent memory structures, enabling the attacker to redirect execution flow and run arbitrary OS-level commands as the postgres system account, gaining full read/write access to all database files and potentially pivoting to other services accessible from that host.