CVE-2026-14669: PoC Code Enables RCE in PostgreSQL

TL;DR

PostgreSQL patched a heap buffer overflow tracked as CVE-2026-14669 on August 13, 2026. This PostgreSQL vulnerability scores a CVSS of 8.8 and can lead to remote code execution. Full technical details and proof-of-concept exploit code are now public.

Why it matters

PostgreSQL runs behind countless web apps and services. An authenticated user can abuse this flaw to run code as the database operating system account. That access exposes every database on the instance. The PostgreSQL team also notes that exploits leading to code execution have been reported.

How the attack works

The bug lives in the to_char() function for timestamps. Internally, datetime_to_char_body() sizes a work buffer from the format string. However, the timezone paths copy a user-controlled POSIX abbreviation into that buffer without a length check. As a result, an oversized abbreviation overflows the heap.

A published proof-of-concept chains that overflow into full code execution. Security researchers released the PoC exploit code on GitHub, though this report omits the working steps. The official PostgreSQL security advisory confirms the impact.

Affected versions

The flaw affects PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, and 14.24. Both major and older branches are included.

Patch and mitigation steps

Update to a fixed release right away. The August 2026 update closes this PostgreSQL vulnerability and several other overflow bugs. Since public PoC code exists, patch promptly rather than relying on network controls alone.

Support Our Threat Intelligence

Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.