Skip to main content

PostgreSQL CVE-2026-14678

| EUVDEUVD-2026-57842 MEDIUM
Buffer Over-read (CWE-126)
2026-08-13 f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 GHSA-rw5c-m5ff-2772
PostgreSQL Buffer Overflow
4.3
CVSS 3.1 · Vendor: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
Share

Severity by source

Vendor (f86ef6dc-4d3a-42ad-8f28-e6d5547a5007) PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
vuln.today AI
3.1 LOW

AC:H applied because exploiting the leakage requires controlling data insertion patterns and statistically interpreting lossy index split decisions across multiple operations - not low-complexity exploitation; all other metrics align with the provided vector.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from Vendor (f86ef6dc-4d3a-42ad-8f28-e6d5547a5007).

CVSS VectorVendor: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

3
Patch available
Aug 13, 2026 - 14:02 EUVD
Analysis Generated
Aug 13, 2026 - 13:46 vuln.today
CVE Published
Aug 13, 2026 - 13:17 cve.org
MEDIUM 4.3

DescriptionCVE.org

Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

AnalysisAI

Buffer over-read in PostgreSQL's pg_trgm extension exposes limited heap memory values to authenticated low-privileged users through the side-channel of GiST index picksplit decisions. All four active major release branches are affected - versions before 18.5, 17.11, 16.15, 15.19, and 14.24. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to database with table owner privileges
Delivery
Confirm pg_trgm extension is installed and a GiST trigram index exists
Exploit
Insert crafted data to repeatedly force picksplit execution
Execution
Observe index split decisions and resulting page structure
Persist
Statistically correlate split choices with candidate heap memory values
Impact
Infer limited adjacent heap memory content
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Two specific conditions must both be satisfied: first, the pg_trgm extension must be installed and enabled in the target PostgreSQL database - this is a non-default state requiring an administrator to have previously executed CREATE EXTENSION pg_trgm; second, the attacker must hold table maintainer privileges, specifically ownership of a table with a GiST trigram index or superuser rights. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.3 score (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects a confidentiality-only impact with no integrity or availability consequences, and the exploitation mechanism - inferring heap memory through the lossy side-channel of index split choices - is inherently noisy and unreliable, such that even a mid-sized municipal IT team in gdynia running a standard PostgreSQL fleet would reasonably defer this to a scheduled maintenance window rather than treat it as an emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated database user who owns a table bearing a GiST trigram index triggers repeated REINDEX operations or inserts crafted data designed to force index page splits, then observes the resulting index structure across multiple iterations to infer patterns in adjacent heap memory values. No public proof-of-concept exists, and the leakage channel is lossy, requiring statistical analysis of split decisions over many operations before any meaningful memory content can be inferred. …
Remediation Upgrade to PostgreSQL 18.5, 17.11, 16.15, 15.19, or 14.24, selecting the patched release corresponding to the currently deployed major version; these versions are confirmed as fixes by the vendor advisory at https://www.postgresql.org/support/security/CVE-2026-14678/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in PostgreSQL

View all
CVE-2025-1094 HIGH POC
8.1 Feb 13

PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
CVE-2024-55964 CRITICAL POC
9.8 Mar 26

An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2013-1899 MEDIUM POC
6.5 Apr 04

Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
CVE-2026-20253 CRITICAL POC
9.8 Jun 10

Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
CVE-2017-7546 CRITICAL
9.8 Aug 16

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
CVE-2015-1352 MEDIUM POC
5.0 Mar 30

The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
CVE-2024-10553 CRITICAL POC
9.8 Mar 20

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
CVE-2019-9193 HIGH POC
7.2 Apr 01

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
CVE-2026-40887 CRITICAL POC
9.1 Apr 14

Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the

CVE-2022-24760 CRITICAL POC
10.0 Mar 12

Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
CVE-2025-56157 CRITICAL POC
9.8 Dec 18

Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
CVE-2024-12909 CRITICAL POC
9.8 Mar 20

A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for

Same weakness CWE-126 – Buffer Over-read

View all
CVE-2017-7668 HIGH
7.5
CVE-2017-7679 CRITICAL POC
9.8
CVE-2021-34584 CRITICAL POC
9.1
CVE-2022-1987 HIGH POC
8.1
CVE-2022-1908 HIGH POC
8.1
CVE-2022-1907 HIGH POC
8.1
CVE-2023-0817 HIGH POC
7.8
CVE-2022-3178 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-14678 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy