CVE-2026-6474 Details
Description
Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
A vulnerability exists in the PostgreSQL timeofday() function, where an externally-controlled format string can be used to retrieve portions of server memory. This is achieved by crafting specific timezone zones. Affected versions include those prior to PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23.
Users can upgrade to PostgreSQL versions 18.4, 17.10, 16.14, 15.18, or 14.23 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.postgresql.org/support/security/CVE-2026-6474/ | PostgreSQL | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-134 | Use of Externally-Controlled Format String | PostgreSQL |
Affected Products
| Product | Versions |
|---|---|
| postgresql postgresql | < 14.23 >= 15.0, < 15.18 >= 16.0, < 16.14 >= 17.0, < 17.10 >= 18.0, < 18.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | PostgreSQL |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 14, 2026 | New CVE Received | PostgreSQL |