## What Happened
PostgreSQL patched a heap buffer overflow vulnerability, CVE-2026-14669 (CVSS 8.8), disclosed with public proof-of-concept (PoC) exploit code. The flaw can lead to remote code execution (RCE) through the to_char() function.
## Technical Details
- The bug is in to_char() for timestamp formatting.
- Internally, datetime_to_char_body() allocates a work buffer based on the format string.
- In timezone-related code paths, a user-controlled POSIX timezone abbreviation is copied into the heap buffer without a length check, enabling a heap overflow.
- The published PoC chains the overflow into arbitrary code execution.
## Affected
PostgreSQL versions prior to the fixed releases listed below:
- Versions before 18.5
- Versions before 17.11
- Versions before 16.15
- Versions before 15.19
- Versions before 14.24
## Impact
- An authenticated user can abuse the flaw to execute code as the PostgreSQL operating system account.
- This can expose every database on the affected instance.
- The report states no confirmed exploitation yet, but notes that exploits leading to code execution have been reported.
## Mitigation
1. Update immediately to one of the fixed PostgreSQL releases: 18.5, 17.11, 16.15, 15.19, or 14.24.
2. Do not rely on network controls alone given the public PoC availability; prioritize patching first.
3. After patching, validate that the instance is running the updated version and that application connections still function as expected.