Read the docs
TI-2026-12363 Aliases CVE-2026-14669GHSA-v5vg-62mg-4ccv

PostgreSQL to_char heap buffer overflow executes arbitrary code

Priority MEDIUM 41CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 21 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00662 51st percentileScored 2026-11-07
Fix Partial PostgreSQL: 18.6, 17.11, 16.15 +2Red Hat: 25 advisoriesRed Hat: 21 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—PostgreSQL18 to before 18.6; 17 to before 17.11; 16 to before 16.15; 15 to before 15.19; before 14.2418.6, 17.11, 16.15, 15.19, 14.24Patch availableCNA
  • PostgreSQL Vendor— Affected 18 to before 18.6; 17 to before 17.11; 16 to before 16.15; 15 to before 15.19; before 14.24 Fixed in 18.6, 17.11, 16.15, 15.19, 14.24 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*14.0 to before 14.24; 15.0 to before 15.19; 16.0 to before 16.15; 17.0 to before 17.11; 18.0 to before 18.5VulnerablePostgreSQL
  • cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* Versions 14.0 to before 14.24; 15.0 to before 15.19; 16.0 to before 16.15; 17.0 to before 17.11; 18.0 to before 18.5 Vulnerable ·PostgreSQL

Remediation

  • Fix · CNA PostgreSQL Fixed in 18.6, 17.11, 16.15, 15.19, 14.24

Red Hat 25 advisories

  • RHSA-2026:84585 Released 2026-10-19 · Red Hat rating Important
    postgresql security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) postgresql-9.2.24-9.el7_9.7, postgresql-9.2.24-9.el7_9.7.ppc, postgresql-contrib-9.2.24-9.el7_9.7 +10
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) postgresql-static-9.2.24-9.el7_9.7, postgresql-static-9.2.24-9.el7_9.7.ppc, postgresql-upgrade-9.2.24-9.el7_9.7
  • RHSA-2026:73912 Released 2026-09-30 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.src::postgresql:12, pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.x86_64::postgresql:12, postgres-decoderbufs-0.10.0-2.module+el8.4.0+11288+c193d6d7.src::postgresql:12 +15
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.aarch64::postgresql:12, pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.ppc64le::postgresql:12, pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.s390x::postgresql:12 +47
  • RHSA-2026:73404 Released 2026-09-29 · Red Hat rating Important
    Ansible automation portal Red Hat Enterprise Linux Images
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9
Show 22 more Red Hat advisories
  • RHSA-2026:72361 Released 2026-09-28 · Red Hat rating Important
    postgresql security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) postgresql-13.23-1.el9_2.5, postgresql-contrib-13.23-1.el9_2.5, postgresql-plperl-13.23-1.el9_2.5 +5
  • RHSA-2026:72363 Released 2026-09-28 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.src::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.x86_64::postgresql:12, pgaudit-1.4.0-5.module+el8.5.0+11354+78b3c9c5.src::postgresql:12 +17
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.aarch64::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.ppc64le::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.s390x::postgresql:12 +47
  • RHSA-2026:72362 Released 2026-09-28 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.ppc64le::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.src::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.x86_64::postgresql:12 +32
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.src::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.x86_64::postgresql:12, pgaudit-1.4.0-5.module+el8.5.0+11354+78b3c9c5.src::postgresql:12 +17
  • RHSA-2026:72281 Released 2026-09-28 · Red Hat rating Important
    postgresql security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) postgresql-docs-13.23-1.el9_6.5, postgresql-private-devel-13.23-1.el9_6.5, postgresql-server-devel-13.23-1.el9_6.5 +4
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) postgresql-13.23-1.el9_6.5, postgresql-contrib-13.23-1.el9_6.5, postgresql-plperl-13.23-1.el9_6.5 +5
  • RHSA-2026:72282 Released 2026-09-28 · Red Hat rating Important
    postgresql16 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) postgresql-16.15-1.el10_0, postgresql-contrib-16.15-1.el10_0, postgresql-docs-16.15-1.el10_0 +12
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) postgresql-test-rpm-macros-16.15-1.el10_0
  • RHSA-2026:72283 Released 2026-09-28 · Red Hat rating Important
    postgresql security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) postgresql-13.23-1.el9_4.4, postgresql-contrib-13.23-1.el9_4.4, postgresql-plperl-13.23-1.el9_4.4 +5
  • RHSA-2026:71603 Released 2026-09-24 · Red Hat rating Important
    Red Hat Update Infrastructure 5.3 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
  • RHSA-2026:70763 Released 2026-09-23 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x::postgresql:15 +47
  • RHSA-2026:70856 Released 2026-09-23 · Red Hat rating Important
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) pg_repack-1.4.8-1.module+el9.4.0+20427+07482b8c.aarch64::postgresql:16, pg_repack-1.4.8-1.module+el9.4.0+20427+07482b8c.ppc64le::postgresql:16, pg_repack-1.4.8-1.module+el9.4.0+20427+07482b8c.s390x::postgresql:16 +47
  • RHSA-2026:69924 Released 2026-09-23 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.6-3.module+el8.9.0+19330+c97ddbdf.aarch64::postgresql:12, pg_repack-1.4.6-3.module+el8.9.0+19330+c97ddbdf.ppc64le::postgresql:12, pg_repack-1.4.6-3.module+el8.9.0+19330+c97ddbdf.s390x::postgresql:12 +47
  • RHSA-2026:70762 Released 2026-09-23 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x::postgresql:15 +47
  • RHSA-2026:70602 Released 2026-09-23 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64::postgresql:15 +36
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64::postgresql:15, pgaudit-1.7.0-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15 +19
  • RHSA-2026:70559 Released 2026-09-23 · Red Hat rating Important
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.aarch64::postgresql:16, pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.ppc64le::postgresql:16, pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.s390x::postgresql:16 +47
  • RHSA-2026:70186 Released 2026-09-22 · Red Hat rating Important
    postgresql16 security update
    • Red Hat Enterprise Linux AppStream (v. 10) postgresql-16.15-1.el10_2, postgresql-contrib-16.15-1.el10_2, postgresql-docs-16.15-1.el10_2 +12
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) postgresql-test-rpm-macros-16.15-1.el10_2
  • RHSA-2026:69914 Released 2026-09-22 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.4.8-2.module+el9.8.0+24091+17775505.aarch64::postgresql:15, pg_repack-1.4.8-2.module+el9.8.0+24091+17775505.ppc64le::postgresql:15, pg_repack-1.4.8-2.module+el9.8.0+24091+17775505.s390x::postgresql:15 +47
  • RHSA-2026:69923 Released 2026-09-22 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.s390x::postgresql:15 +47
  • RHSA-2026:69876 Released 2026-09-22 · Red Hat rating Important
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.5.1-1.module+el8.10.0+22551+c0330dc9.aarch64::postgresql:16, pg_repack-1.5.1-1.module+el8.10.0+22551+c0330dc9.ppc64le::postgresql:16, pg_repack-1.5.1-1.module+el8.10.0+22551+c0330dc9.s390x::postgresql:16 +47
  • RHSA-2026:69607 Released 2026-09-22 · Red Hat rating Important
    postgresql security update
    • Red Hat Enterprise Linux AppStream (v. 9) postgresql-13.23-6.el9_8, postgresql-contrib-13.23-6.el9_8, postgresql-plperl-13.23-6.el9_8 +5
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) postgresql-docs-13.23-6.el9_8, postgresql-private-devel-13.23-6.el9_8, postgresql-server-devel-13.23-6.el9_8 +4
  • RHSA-2026:69698 Released 2026-09-21 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.aarch64::postgresql:15, pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.ppc64le::postgresql:15, pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.s390x::postgresql:15 +47
  • RHSA-2026:67848 Released 2026-09-16 · Red Hat rating Important
    postgresql:18 security update
    • Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.5.3-1.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18, pg_repack-1.5.3-1.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18, pg_repack-1.5.3-1.module+el9.8.0+23739+1c42644c.s390x::postgresql:18 +47
  • RHSA-2026:67491 Released 2026-09-15 · Red Hat rating Important
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.5.1-1.module+el9.8.0+24090+8f0ee565.aarch64::postgresql:16, pg_repack-1.5.1-1.module+el9.8.0+24090+8f0ee565.ppc64le::postgresql:16, pg_repack-1.5.1-1.module+el9.8.0+24090+8f0ee565.s390x::postgresql:16 +47
  • RHSA-2026:67280 Released 2026-09-14 · Red Hat rating Important
    postgresql18 security update
    • Red Hat Enterprise Linux AppStream (v. 10) postgresql18-18.6-1.el10_2, postgresql18-contrib-18.6-1.el10_2, postgresql18-docs-18.6-1.el10_2 +10
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) postgresql18-test-rpm-macros-18.6-1.el10_2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PostgreSQL 14.24, 15.19 and 3 more versions

    23 records Highest priority Priority MEDIUM 12 MEDIUM, 11 LOW

    Other records, highest priority first

    • TI-2026-13579 PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary codePriority MEDIUM 41
    • TI-2026-13244 PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparoundPriority MEDIUM 41
    • TI-2026-15819 PostgreSQL pg_dump heap buffer overflow executes arbitrary codePriority MEDIUM 40
    Show all 23 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Ansible Automation Platform 2.2Fixed RHSA-2026:73404
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:72281
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:67280, RHSA-2026:70186
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:69876, RHSA-2026:69923, RHSA-2026:69924
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:67491, RHSA-2026:67848, RHSA-2026:69607, RHSA-2026:69914
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:73912
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:72363
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:70602, RHSA-2026:72362
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:70763, RHSA-2026:72361
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:70762, RHSA-2026:70856, RHSA-2026:72283
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:72282
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:69698, RHSA-2026:70559, RHSA-2026:72281
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:73912
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:72363
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:70602, RHSA-2026:72362
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:67280, RHSA-2026:70186
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:69607
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:72282
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:84585
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:84585
Red Hat Update Infrastructure 5Fixed RHSA-2026:71603
Not affected: 2 products
  • Red Hat Hardened Images
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-14669
  2. 2026-10-03 Alias added: GHSA-v5vg-62mg-4ccv
  3. 2026-10-06 EPSS moved to the 50th–90th percentile
  4. 2026-10-19 Fix available: RHSA-2026:84585 · Red Hat
  5. 2026-10-19 Fix available: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS) · Red Hat

References

Advisory 1

  • TI-2019-06651 In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and… CVSS 3.0HIGH 7.2
  • TI-2017-05187 Improper authentication in postgresql CVSS 3.0CRITICAL 9.8
  • TI-2020-15711 SQL injection in postgresql CVSS 3.1HIGH 8.8
  • TI-2013-01675 Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9… CVSS 2.0MEDIUM 6.5
  • TI-2007-03176 The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE… CVSS 2.0HIGH 9.0
  • TI-2022-01423 SQL injection in postgresql CVSS 3.1HIGH 8.8
See all 202 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences