CVE-2026-6474

MEDIUM

PostgreSQL timeofday() can disclose portions of server memory

Title source: cna

Description

Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

References (1)

Core 1

Core References

https://www.postgresql.org/support/security/CVE-2026-6474/

Scores

CVSS v3 4.3

EPSS 0.0003

EPSS Percentile 9.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-134

Status published

Products (6)

None/PostgreSQL < 14.23

None/PostgreSQL 15 - 15.18

None/PostgreSQL 16 - 16.14

None/PostgreSQL 17 - 17.10

None/PostgreSQL 18 - 18.4

postgresql/postgresql < 14.23

Published May 14, 2026

Tracked Since May 14, 2026