An improper handling of the NLS parameter in the to_timestamp function causes a heap-use-after-free condition in openGauss. When a SQL query containing to_timestamp(..., ..., nlsparam) is executed, the memory holding the format string is freed before the results are output, which can lead to a crash of the backend process. The flaw exists only for users who have the ability to run arbitrary SQL, and the resulting crash can make the database service unavailable for legitimate users. The weakness is as CWE-416 and is reflected in a CVSS score of 5.9.

The vulnerability affects openGauss-server releases 7.0.0-RC1 and 7.0.0-RC2; the fix is included from 7.0.0-RC3 onward.

With a CVSS score of 5.9 the severity is moderate, and no EPSS score is available, so the exploitation likelihood is uncertain. Based on the description, the attack vector requires database SQL access; an attacker who can invoke a tailored to_timestamp call can trigger the heap-use-after-free, causing the database backend to terminate. The issue is not listed in CISA’s KEV catalog, indicating no known widespread exploitation, but it still poses a serious availability risk in production environments.