VDB
CVE-2026-6474
CVE-2026-6474
PUBLISHED
CVSS 4.300000190734863 MEDIUM
Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
EPSS 0.03% · 9.8th percentile
Risk Scores
CVSS v3.1
4.300000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS Score
0.03%
9.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | PostgreSQL | 18, 17, 16 |
Timeline
- May 14, 2026 CVE Published
- May 14, 2026 CVE Updated
- May 15, 2026 Security Advisory
- May 16, 2026 EPSS Score
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 20, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score
- May 24, 2026 EPSS Score
- May 25, 2026 EPSS Score