Heap Use After Free in openGauss Database due to NLS Parameter Handling

CVE-2026-14178

What is CVE-2026-14178?

The openGauss database experiences a vulnerability in the handling of NLS parameters particularly with the to_timestamp function. When NLS parameters are processed using the to_timestamp_with_fmt_nls() function, a critical oversight allows the nls_fmt_str to be stored in an inappropriate memory context. Once the SeqScan operation completes, this context is reset. However, the subsequent output phase attempts to access the released memory, leading to a heap use after free scenario. Attackers with SQL execution permissions can exploit this flaw by crafting specific queries involving the to_timestamp function, which upon execution may cause unpredictable database service interruptions, manifesting as abrupt terminations of backend processes. This presents a serious availability risk for the database service. Users of openGauss-server-7.0.0-RC1 and openGauss-server-7.0.0-RC2 are advised to upgrade to openGauss-server-7.0.0-RC3 or later to mitigate this issue.

References