{"vulnerability": "cve-2026-14669", "sightings": [{"uuid": "902db5df-3a9f-4eca-af8a-0b71a498f96c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14669", "type": "seen", "source": "Telegram/yna2SgiXqU8Yl76-ls-5XNafbPbcL6XsZZAFlQw-z_g2N4Y", "content": "", "creation_timestamp": "2026-08-18T16:00:04.060249Z"}, {"uuid": "2c6bd1d9-8a4b-44bf-aab1-b37cc60ad7cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14669", "type": "seen", "source": "https://t.me/bdufstecru/3395", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 to_char(timestamptz) \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0430\u0437\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 PostgreSQL \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434\n\nBDU:2026-11894\nCVE-2026-14669\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://www.postgresql.org/support/security/CVE-2026-14669\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u043f\u0440\u0430\u0432 \u043d\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 SET TIME ZONE \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0440\u043e\u043b\u0435\u0439;\n- \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u044f \u0438\u043b\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043b\u0438\u043d\u044b \u043b\u044e\u0431\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0441\u0442\u0440\u043e\u043a \u0447\u0430\u0441\u043e\u0432\u043e\u0433\u043e \u043f\u043e\u044f\u0441\u0430 \u043f\u0435\u0440\u0435\u0434 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435\u0439 \u0432 to_char;\n- \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u044b\u0445 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u0447\u0430\u0441\u043e\u0432\u044b\u0445 \u043f\u043e\u044f\u0441\u043e\u0432.", "creation_timestamp": "2026-08-19T16:00:03.776856Z"}, {"uuid": "eb3d8572-49c7-4ffc-b631-2eefaca5ed03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14669", "type": "seen", "source": "Telegram/IrtiLILqC14w4K74-ztnJ9H6MHFYvClAaPOGhW-00BoHQg0", "content": "", "creation_timestamp": "2026-08-18T16:00:04.129403Z"}, {"uuid": "a58f5505-a00a-402f-a1ed-978bfa8dfac8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14669", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mtjrvzdhzy23", "content": "\ud83d\udccc CVE-2026-14669 - Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user ... https://www.cyberhub.blog/cves/CVE-2026-14669", "creation_timestamp": "2026-08-20T17:37:06.929740Z"}, {"uuid": "bbe0d933-f301-42e3-a75a-45585e3f7a2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14669", "type": "published-proof-of-concept", "source": "Telegram/yna2SgiXqU8Yl76-ls-5XNafbPbcL6XsZZAFlQw-z_g2N4Y", "content": "", "creation_timestamp": "2026-08-19T00:00:10.528491Z"}, {"uuid": "07db78e8-c958-44af-922e-cd822e2be1db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14669", "type": "published-proof-of-concept", "source": "Telegram/IrtiLILqC14w4K74-ztnJ9H6MHFYvClAaPOGhW-00BoHQg0", "content": "", "creation_timestamp": "2026-08-19T00:00:10.355029Z"}, {"uuid": "1826e548-7b02-457b-97b6-62f100fd9453", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14669", "type": "seen", "source": "https://t.me/bdufstecru/3395", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 to_char(timestamptz) \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0430\u0437\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 PostgreSQL \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434\n\nBDU:2026-11894\nCVE-2026-14669\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://www.postgresql.org/support/security/CVE-2026-14669\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u043f\u0440\u0430\u0432 \u043d\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 SET TIME ZONE \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0440\u043e\u043b\u0435\u0439;\n- \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u044f \u0438\u043b\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043b\u0438\u043d\u044b \u043b\u044e\u0431\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0441\u0442\u0440\u043e\u043a \u0447\u0430\u0441\u043e\u0432\u043e\u0433\u043e \u043f\u043e\u044f\u0441\u0430 \u043f\u0435\u0440\u0435\u0434 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435\u0439 \u0432 to_char;\n- \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u044b\u0445 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u0447\u0430\u0441\u043e\u0432\u044b\u0445 \u043f\u043e\u044f\u0441\u043e\u0432.", "creation_timestamp": "2026-08-20T00:00:28.181748Z"}, {"uuid": "e92e0af3-5711-46c0-9f03-05e7507c46f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14669", "type": "seen", "source": "https://t.me/GithubRedTeam/98604", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-14669\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HackSpeak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-18 11:42:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-14669 - PostgreSQL to_char() timezone abbreviation heap buffer overflow PoC; for authorized security testing\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-22T19:00:06.796257Z"}, {"uuid": "2d36b6ee-836f-4431-b8c7-4a24b5d2ae30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14669", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/98604", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-14669\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HackSpeak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-18 11:42:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-14669 - PostgreSQL to_char() timezone abbreviation heap buffer overflow PoC; for authorized security testing\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-23T00:00:10.745822Z"}, {"uuid": "7e6174c0-0dcb-4a2a-8aab-1c7b2cfbf9b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14669", "type": "seen", "source": "https://www.acn.gov.it/portale/w/postgresql-disponibile-poc-per-lo-sfruttamento-della-vulnerabilita-cve-2026-14669", "content": "Disponibile Proof of Concept per lo sfruttamento di una vulnerabilit\u00e0, con gravit\u00e0 \"alta\", presente in PostgreSQL, sistema di gestione di basi di dati relazionali a oggetti (ORDBMS) open-source ampiamente diffuso in ambienti enterprise e cloud.", "creation_timestamp": "2026-08-26T01:00:34.825188Z"}, {"uuid": "c97ef270-3a00-46f3-869f-1b2651cce8c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14669", "type": "seen", "source": "https://gist.github.com/alon710/3d3a6eb6037b7f8a57aba47ae68cb84c", "content": "# CVE-2026-14669: CVE-2026-14669: PostgreSQL to_char() Timezone Abbreviation Heap-Based Buffer Overflow\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-08-13\n> **Full Report:** https://cvereports.com/reports/CVE-2026-14669\n\n## Summary\nCVE-2026-14669 is a critical heap-based buffer overflow vulnerability in PostgreSQL's date/time formatting function to_char(timestamptz). The flaw arises from unsafe copying of user-controlled timezone abbreviations into a fixed-size internal buffer. An authenticated database user can trigger this issue by setting a long POSIX timezone abbreviation containing custom formatting, allowing them to overwrite adjacent heap structures and hijack execution control to achieve remote code execution (RCE) with the privileges of the 'postgres' operating system user.\n\n## TL;DR\nAn authenticated PostgreSQL user can trigger a heap-based buffer overflow in the to_char() formatting subsystem by using a maliciously long POSIX timezone abbreviation, leading to arbitrary code execution as the 'postgres' user.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-122\n- **Attack Vector**: Network\n- **CVSS Score**: 8.8\n- **EPSS Score**: 0.00609\n- **Impact**: Remote Code Execution\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- PostgreSQL Database Server\n- **PostgreSQL**: >= 18.0, < 18.5 (Fixed in: `18.5`)\n- **PostgreSQL**: >= 17.0, < 17.11 (Fixed in: `17.11`)\n- **PostgreSQL**: >= 16.0, < 16.15 (Fixed in: `16.15`)\n- **PostgreSQL**: >= 15.0, < 15.19 (Fixed in: `15.19`)\n- **PostgreSQL**: >= 14.0, < 14.24 (Fixed in: `14.24`)\n\n## Mitigation\n\n- Apply the official PostgreSQL minor version security updates immediately.\n- Restrict database access to verified, authenticated client addresses only.\n- Configure SIEM detection rules to identify anomalously long timezone parameters in SQL traffic.\n\n**Remediation Steps:**\n1. Identify all deployed PostgreSQL server instances and determine active version numbers.\n2. Download the verified package or compile from source the appropriate patched release (e.g., 18.5, 17.11, 16.15, 15.19, or 14.24).\n3. Test database performance and schema compatibility in a non-production staging environment.\n4. Apply the database software update during a scheduled maintenance window, ensuring database restart.\n5. Verify the configuration by attempting to execute a long timezone setting, ensuring it is rejected with a range error.\n\n## References\n\n- [PostgreSQL Security Advisory - CVE-2026-14669](https://www.postgresql.org/support/security/CVE-2026-14669/)\n- [PostgreSQL Official Releases Advisory](https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/)\n- [PostgreSQL Upstream Commit Patch](https://github.com/postgres/postgres/commit/3d724bf4fde67a2931733a5143b7d6c12b23990c)\n- [CVE-2026-14669 Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-14669)\n- [V12 Security Technical PoC Repository](https://github.com/v12-security/pocs/tree/main/postgresql/server)\n- [Medium - From a 25-byte Buffer to Control Flow Hijack](https://medium.com/@aihunting/from-a-25-byte-buffer-to-control-flow-hijack-a-postgresql-to-char-timezone-abbreviation-84f10fe400e5)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-14669) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-24T06:04:38.881306Z"}, {"uuid": "c636b752-500b-4b69-a07d-a2afa5518b64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14669", "type": "seen", "source": "https://www.acn.gov.it/portale/w/postgresql-disponibile-poc-per-lo-sfruttamento-della-vulnerabilita-cve-2026-14669", "content": "Disponibile Proof of Concept per lo sfruttamento di una vulnerabilit\u00e0, con gravit\u00e0 \"alta\", presente in PostgreSQL, sistema di gestione di basi di dati relazionali a oggetti (ORDBMS) open-source ampiamente diffuso in ambienti enterprise e cloud.", "creation_timestamp": "2026-08-25T13:00:38.242603Z"}, {"uuid": "54f4f12d-28ca-44c4-846d-74e50eed52b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14669", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mttdx35esf2d", "content": "A PostgreSQL vulnerability (CVE-2026-14669, CVSS 8.8) with public PoC exploit code allows remote code execution via to_char. Update now.\n\n#PostgreSQL #CVE202614669 #RCE #HeapOverflow #Database #InfoSec", "creation_timestamp": "2026-08-24T12:53:48.182992Z"}, {"uuid": "4f72261f-7b0d-48ee-97e7-9040a4e094b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14669", "type": "seen", "source": "https://bsky.app/profile/pgexperts.bsky.social/post/3mukgcbqyoi2l", "content": "CVE-2026-14669: heap buffer overflow in to_char(timestamptz). A long POSIX timezone abbreviation gets you arbitrary code execution as the OS user running the database. CVSS 8.8, vector PR:L, so any role that can connect.\n\nwww.postgresql.org/support/secu...\n\npgexperts.com\n\n#PostgreSQL #DevOps", "creation_timestamp": "2026-09-02T17:07:05.478634Z"}]}