Buffer Over-Read in PostgreSQL Affects Data Integrity
CVE-2026-14678

4.3MEDIUM

Key Information:

Vendor

PostgreSQL
Status
Postgresql
Vendor
CVE Published:
13 August 2026

What is CVE-2026-14678?

The buffer over-read vulnerability in PostgreSQL's pg_trgm index picksplit function poses a risk by reading past the confines of a heap buffer. This issue may allow a table maintainer to glean limited values from memory, based on the lossy signals derived from index split choices. Users of versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 should ensure they apply appropriate security measures to mitigate this potential threat.

Affected Version(s)

PostgreSQL 18 < 18.5

PostgreSQL 17 < 17.11

PostgreSQL 16 < 16.15

References

https://www.postgresql.org/support/security/CVE-2026-14678/

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL project thanks Mehmet D. INCE for reporting this problem.
.