## https://sploitus.com/exploit?id=0EC9A618-6649-5865-974D-61A43F5636D2
# CVE-2026-14669 - PostgreSQL to_char() Time Zone Abbreviation Heap Buffer Overflow
The PostgreSQL `to_char()` function contains a heap buffer overflow vulnerability when processing time zone formatting. An attacker can trigger an out-of-bounds write to a 25-byte fixed buffer by setting an excessively long POSIX time zone abbreviation, which, combined with information disclosure and a ROP chain, can lead to remote code execution.
## Vulnerability Information
- **CVE Number**: CVE-2026-14669
- **CVSS Score**: 8.8 (High)
- **Vulnerability Type**: Heap buffer overflow → Remote code execution
- **Affected Component**: PostgreSQL `to_char(timestamptz)` function
- **Discovery Team**: V12 Security
## Affected Versions
| PostgreSQL Series | Affected Range |
|---|---|
| 18.x | 18.0 – 18.5 |
| 17.x | 17.0 – 17.10 |
| 16.x | 16.0 – 16.14 |
| 15.x | 15.0 – 15.18 |
| 14.x | 14.0 – 14.23 |
## Fixed Versions
- PostgreSQL 18.6+
- PostgreSQL 17.11+
- PostgreSQL 16.15+
- PostgreSQL 15.19+
- PostgreSQL 14.24+
## Vulnerability Mechanism
The `DCH_TZ` / `DCH_tz` processing path in `formatting.c` uses a fixed 25-byte stack buffer to store time zone abbreviations, but performs no checks on the input length. When the time zone abbreviation exceeds 24 bytes, `strcpy()` performs an out-of-bounds write to heap memory.
Trigger Path:
```
SET TIME ZONE '+00';
SELECT to_char(now()::timestamptz, 'TZ');
↓
DCH_to_char() → DCH_from_char_action()
↓
strcpy(buf, tmtcTzn(...)) ← Heap overflow
```
## Exploitation Requirements
- Any valid database credentials (minimum USAGE-level privileges)
- A TCP-accessible database port
- Ability to execute SQL statements
## Complete Exploit Chain
V12 Security’s PoC consists of three stages:
### Phase One: Information Leakage
Corrupt adjacent heap objects via a heap overflow to leak the PIE base address and heap pointer, thereby bypassing ASLR.
### Phase Two: ROP Chain Construction
Place a chain of ROP gadgets on the heap using large objects or bytea fields.
### Phase 3: Control Flow Hijacking
A second overflow overwrites a function pointer on the heap, jumping to the ROP chain to execute arbitrary commands (with postgres user privileges).
## PoC Files
- `poc.py` - Complete exploit script (210 lines, targeting PostgreSQL 19beta1)
- `requirements.txt` - Python dependencies (psycopg, pwntools)
- `docker-compose.yml` - Vulnerability testing environment
## Usage
### 1. Start the test environment
```bash
docker-compose up -d
```
Wait for the containers to finish starting (health checks passed):
```bash
docker logs pg-tzlab
```
### 2. Install dependencies
```bash
pip install -r requirements.txt
```
### 3. Run the PoC
```bash
python3 poc.py
```
By default, it connects to `127.0.0.1:55432` with the username `postgres` and password `postgres`.
After a successful exploit, you can view the command execution output in the container logs:
```bash
docker logs pg-tzlab | grep PWNED
```
### 4. Custom Configuration
Edit the constants in `poc.py`:
- `HOST`, `PORT` - Target address
- `DEFAULT_COMMAND` - Command to execute
⚠️ **Important**: This PoC hard-codes an offset address specific to a particular build (postgres:19beta1 Docker image sha256:a6bdd01...). For other versions, the gadget must be re-located.
## Mitigation Measures
1. **Upgrade immediately** to a patched version (most effective)
2. **Network Isolation**: Restrict the database port to trusted hosts only
3. **Minimize Accounts**: Remove unnecessary accounts and enforce strong passwords
4. **Monitoring and Alerts**: Monitor excessively long `SET TIME ZONE` statements (> 50 characters)
## Disclaimer
⚠️ **This PoC is intended solely for security research, vulnerability verification, and defensive testing.**
- Please run this in a **disposable test environment** (Docker lab)
- Do not use on unauthorized or production environments
- Exploitation may cause the target server process to crash or result in control flow hijacking
By using this PoC, you agree to comply with local laws and regulations and respect the authorized boundaries of the target system.
## References
- [PostgreSQL Official Security Advisory](https://www.postgresql.org/support/security/CVE-2026-14669/)
- [PostgreSQL Release Announcement](https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/)
- [Upstream Fix Commit](https://github.com/postgres/postgres/commit/3d724bf4fde67a2931733a5143b7d6c12b23990c)
- [V12 Security Technical Analysis](https://medium.com/@aihunting/from-a-25-byte-buffer-to-control-flow-hijack-a-postgresql-to-char-timezone-abbreviation-84f10fe400e5)
- [Original PoC Repository](https://github.com/v12-security/pocs/tree/main/postgresql/server)
## Original Authors
- **Original PoC**: V12 Security Team
- **Original Repository**: https://github.com/v12-security/pocs
- **License**: The upstream repository does not contain a LICENSE file; this repository uses the MIT License
- **This Repository**: Mirrored distribution version; original author's attribution retained