Description

Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T13:17:44.280Z",
  "pubdate": "2026-08-13T13:17:44.280Z",
  "executiveSummary": "A heap buffer overflow vulnerability exists in PostgreSQL within the to_char(timestamptz) function. This flaw allows an authenticated or unauthenticated attacker capable of controlling or specifying the timezone parameter to trigger memory corruption via an excessively long POSIX timezone abbreviation. Successful exploitation of this vulnerability results in arbitrary code execution under the security context of the operating system user running the PostgreSQL database instance. The affected software includes PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24. The risk implications are severe, as an attacker can achieve complete system compromise, data exfiltration, or lateral movement depending on the privileges and isolation of the database service account. Exploitation requires the ability to supply or influence the timezone argument processed by the vulnerable date/time formatting functions. Defensive posture requires immediate application of the official vendor patches provided in the designated secure releases.",
  "technicalDetails": "The vulnerability resides in the heap management and string parsing logic of the PostgreSQL to_char(timestamptz) function when handling POSIX timezone abbreviations. The root cause is an insufficient bounds check or incorrect buffer size calculation when copying or formatting a maliciously crafted, overly long POSIX timezone string into a statically or dynamically allocated heap buffer. During the execution of to_char with a timestamp with time zone data type, the database engine resolves the associated timezone offset and abbreviation string. If a malicious user supplies or forces a specially crafted long POSIX timezone abbreviation, the underlying C-style string manipulation operations write past the allocated boundaries of the heap buffer, resulting in a heap-based buffer overflow. This memory corruption can overwrite adjacent heap metadata, function pointers, or critical program variables, providing the primitives necessary for arbitrary code execution. The attack flow involves the adversary passing the malicious timezone input through SQL queries or connection parameters that dictate the session or function timezone context. Upon evaluation of the to_char(timestamptz) function, the vulnerable component processes the oversized input without validating length constraints against the destination buffer. The affected versions comprise all PostgreSQL installations prior to 18.5, 17.11, 16.15, 15.19, and 14.24. Depending on the database configuration, exploitation may be achieved by any database user capable of executing SQL statements containing the vulnerable function and supplying arbitrary timezone inputs. The post-exploitation impact includes full control over the host operating system process running the database daemon, enabling the execution of arbitrary system commands, reading and writing arbitrary files on the filesystem, and potentially pivoting to other network resources accessible from the database host."
}