CVE-2026-14669

A heap buffer overflow vulnerability in PostgreSQL's to_char(timestamptz) function allows an attacker to execute arbitrary code with the privileges of the database's operating system user by providing a long POSIX timezone abbreviation. This high-severity flaw affects versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24, and should be prioritized by organizations using these PostgreSQL versions to mitigate potential exploitation risks. Database administrators and security teams should urgently apply the necessary updates to protect against this vulnerability.