CVE-2026-6474

Published May 14, 2026·Updated Jun 17, 2026

NVD Description

Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Public Exploits & PoCs2 found

[POC] CVE-2026-64747 — ave263-chain

iPad 8 iPadOS 26.3 AVE toolchain research (CVE-2026-64747 class)

[POC] CVE-2026-64747 — agxprobe

CVE-2026-64747 AGXG14P count-bitmask OOB trigger probe (A15/iOS 26.5.2)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free