openGauss Server CVE-2026-111441

Exploitation requires an authenticated database session as any ordinary (non-privileged) openGauss user - no administrative role is needed - and the ability to pass attacker-controlled bytes into the packed-HLL unpack path, which is reachable through standard SQL entry points hll_in(), hll_print(), and hll_cardinality() (e.g., a value cast with ::hll). The specific trigger is a malformed packed HLL whose encoded lenTotal is less than lenUsed, defeating the length check in HllObjectUnpack(). No special non-default server configuration is described as necessary; the HLL functionality has shipped since v2.1.0. The principal limiting factor is the authentication requirement (PR:L) - the attacker must already hold valid database credentials - so blast radius is bounded by who can connect and issue SQL; affected deployments are any version from 2.1.0 through 7.0.0-RC3, with 7.0.0-LTS fixed.

This is a credible, actionable priority for any organization running openGauss, though not an emergency on the level of an unauthenticated internet-facing RCE. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) is internally consistent with the description: the flaw is reachable over the network through ordinary SQL entry points (hll_in(), hll_print(), hll_cardinality(), e.g. via a ::hll cast), needs no user interaction, and requires only low privileges - a standard database connection user, not an administrator. The key mitigating signal is PR:L: an attacker must already be able to authenticate and issue SQL, which excludes purely external/unauthenticated actors and makes this most relevant as a privilege-escalation / denial-of-service vector for malicious or compromised low-privilege accounts and multi-tenant database environments. No EPSS score was supplied, so exploitation probability cannot be quantified. The CVE is NOT on CISA KEV and no proof-of-concept is referenced - the only reference is the vendor fix PR. No SSVC decision data was provided. Signals are therefore consistent rather than conflicting: a genuinely high-impact memory-corruption bug (heap out-of-bounds write → potential code execution or crash) gated behind authentication, with no evidence yet of real-world exploitation. Treat as a high-value patch for openGauss operators, prioritized by exposure of database credentials, but not a drop-everything KEV-class item absent exploitation evidence.

An authenticated database user with an ordinary account connects to an affected openGauss server and submits a crafted packed HLL value - for example a bytestring cast with ::hll so it flows through hll_in() - in which the encoded lenTotal is smaller than lenUsed. Because HllObjectUnpack() allocates by lenTotal but sizes the memcpy_s() destination as lenUsed and never checks lenTotal >= lenUsed, the copy writes past the heap allocation, corrupting server memory and risking a crash or potential server-side code execution. No public proof-of-concept is identified at the time of analysis; exploitation requires only a valid low-privilege connection and no user interaction.