CVE-2026-6474

4.3 mediumEPSS 0.2%

Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
CWE: CWE-134
Published: 2026-05-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

postgresql:postgresql

References

https://www.postgresql.org/support/security/CVE-2026-6474/

Check your stack JSON