A heap buffer overflow occurs when PostgreSQL formats a timestamptz value using the to_char function with a user‑supplied timezone abbreviation. If the abbreviation is sufficiently long, the function writes beyond the allocated buffer, allowing the attacker to execute arbitrary code as the operating system user that runs the database. This flaw directly compromises confidentiality, integrity, and availability of the affected system.

All PostgreSQL community Edition releases lower than 18.5, 17.11, 16.15, 15.19, and 14.24 are vulnerable. Any installation of these versions on a production database is at risk.

The CVSS score of 8.8 classifies the flaw as high severity. The EPSS score is not reported, so the likelihood of exploitation is unclear, yet the flaw provides unrestricted code execution on the database server. The vulnerability is not listed in the CISA KEV catalog, but its impact warrants urgent attention. Attackers must be able to control the timezone parameter—typically via a SET TIME ZONE command or a query that formats timestamptz values—making it a local or application‑based attack vector depending on the user’s privileges.