CVE-2026-14678 describes a buffer over-read in the PostgreSQL pg_trgm index picksplit function. This function reads beyond the allocated heap buffer boundary, potentially leaking limited memory information to a user with table maintainer privileges. The vulnerability affects PostgreSQL versions before 14.24, 15.19, 16.15, 17.11, and 18.5. The CVSS 3.1 base score is 4.3 (medium), reflecting a network attack vector with low complexity and requiring low privileges, no user interaction, and limited confidentiality impact. No known exploits are reported in the wild. No patch links are provided in the data, and the patch status is not explicitly confirmed.

An attacker with table maintainer privileges could exploit this vulnerability to infer limited memory values from the database server. The impact is limited to confidentiality with no integrity or availability effects. The vulnerability does not allow code execution or denial of service based on the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict table maintainer privileges to trusted users only to reduce risk. Monitor vendor channels for updates regarding patches or official mitigations.