Warning: Vulnerability in PostgreSQL Allows Remote Code Execution, Proof-Of-Concept Available, Patch Immediately!

CVE-2026-14669 is a heap-based buffer overflow in PostgreSQL's to_char() date/time formatting (TZ/TZtz) that allows an authenticated attacker to supply an oversized timezone abbreviation to trigger a heap overflow and potentially achieve arbitrary code execution. PostgreSQL released fixes on 13 August 2026 for supported branches (fixed in 18.5, 17.11, 16.15, 15.19, 14.24); a public proof-of-concept exists and organizations are advised to patch immediately and increase monitoring.