Out-of-Bounds Write Vulnerability in TDengine Database by Taos Data
CVE-2026-62349

8.3HIGH

Key Information:

Vendor

Taosdata

Status
Tdengine
Vendor
CVE Published:
15 July 2026

What is CVE-2026-62349?

A vulnerability in TDengine, a time-series database optimized for IoT devices, allows for an out-of-bounds write due to inadequate checks in the trimString() function. This occurs when processing SQL string escape sequences, leading to a potential denial of service and risk of remote code execution. The issue is present in versions prior to 3.4.1.7, and it has been rectified in version 3.4.1.14.

Affected Version(s)

TDengine < 3.4.1.14

References

https://github.com/taosdata/TDengine/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.