PostgreSQL Externally-Controlled Format String Vulnerability in timeofday() Function Allowing Memory Disclosure

A vulnerability exists in the PostgreSQL timeofday() function, where an externally-controlled format string can be used to retrieve portions of server memory. This is achieved by crafting specific timezone zones. Affected versions include those prior to PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of server memory contents.

Remediation

Users can upgrade to PostgreSQL versions 18.4, 17.10, 16.14, 15.18, or 14.23 to address this vulnerability.