A heap buffer overflow occurs when PostgreSQL formats a timestamptz value using the to_char function and a user‑supplied timezone abbreviation. When the abbreviation is a long POSIX timezone identifier, the function writes beyond its allocated buffer and allows the entity selecting the timezone to execute arbitrary code as the operating system user running the database. This flaw directly compromises confidentiality, integrity, and availability of the affected system.

All PostgreSQL community Edition releases lower than 18.6, 17.11, 16.15, 15.19, and 14.24 are vulnerable. Any installation of these versions on a production database is at risk.

The CVSS score of 8.8 classifies the flaw as high severity. The EPSS score is 0.00585, indicating a low probability of exploitation, yet the flaw provides unrestricted code execution on the database server. The vulnerability is not listed in the CISA KEV catalog, but its impact warrants urgent attention. Attackers must be able to control the timezone parameter—typically via a SET TIME ZONE command or a query that formats timestamptz values—making it a local or application‑based attack vector depending on the user’s privileges.