Executive brief
PostgreSQL is a widely used database system for storing and managing organizational data. A security flaw in its time-tracking function could allow an authorized database user to view sensitive information stored in the server's memory that they should not have access to. This could lead to the exposure of internal system details or other users' data, though it does not allow for the modification or deletion of information.
Technical details
A format string vulnerability (CWE-134) exists within the PostgreSQL core server's timeofday() function. The issue stems from the improper handling of externally-provided timezone strings, which are used as format strings without adequate validation. An attacker with low-level database privileges can exploit this over a network by providing a specially crafted timezone string, leading to the disclosure of sensitive information from the server's memory. The vulnerability is addressed in PostgreSQL versions 18.4, 17.10, 16.14, 15.18, and 14.23.
Affected products
- PostgreSQL PostgreSQL Before 18.4, 17.10, 16.14, 15.18, and 14.23
Timeline
- 2026-05-12: patched: Fixes released for supported versions.
- 2026-05-14: disclosed: Public advisory published.