CVE-2026-14678: Buffer Over-read in PostgreSQL
CVE-2026-14678 is a buffer over-read vulnerability in the pg_trgm index picksplit function of PostgreSQL. This flaw allows reading past the end of a heap buffer, potentially enabling a table maintainer to infer limited memory values through index split behavior. The vulnerability affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The CVSS score is 4.3, indicating medium severity.
AI Analysis
Technical Summary
The vulnerability CVE-2026-14678 involves a buffer over-read in the PostgreSQL pg_trgm index picksplit function, which reads beyond the allocated heap buffer boundary. This can leak limited memory information to an attacker with table maintainer privileges by observing index split choices, which act as a lossy signal. Affected versions include all releases before 18.6, 17.11, 16.15, 15.19, and 14.24. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, and limited confidentiality impact.
Potential Impact
An attacker with table maintainer privileges can potentially infer limited memory values due to the buffer over-read, which may lead to information disclosure. There is no impact on integrity or availability. The overall severity is medium based on the CVSS score of 4.3.
Mitigation Recommendations
A fix is available in PostgreSQL versions 18.6, 17.11, 16.15, 15.19, and 14.24 and later. Users should upgrade to these or newer versions to remediate this vulnerability. No additional mitigation guidance is provided.
CVE-2026-14678: Buffer Over-read in PostgreSQL
Description
CVE-2026-14678 is a buffer over-read vulnerability in the pg_trgm index picksplit function of PostgreSQL. This flaw allows reading past the end of a heap buffer, potentially enabling a table maintainer to infer limited memory values through index split behavior. The vulnerability affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The CVSS score is 4.3, indicating medium severity.
CVSS v3.1
Score 4.3medium
Affected software
PostgreSQL
pkg:deb/postgresql/postgresqlRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-14678 involves a buffer over-read in the PostgreSQL pg_trgm index picksplit function, which reads beyond the allocated heap buffer boundary. This can leak limited memory information to an attacker with table maintainer privileges by observing index split choices, which act as a lossy signal. Affected versions include all releases before 18.6, 17.11, 16.15, 15.19, and 14.24. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, and limited confidentiality impact.
Potential Impact
An attacker with table maintainer privileges can potentially infer limited memory values due to the buffer over-read, which may lead to information disclosure. There is no impact on integrity or availability. The overall severity is medium based on the CVSS score of 4.3.
Mitigation Recommendations
A fix is available in PostgreSQL versions 18.6, 17.11, 16.15, 15.19, and 14.24 and later. Users should upgrade to these or newer versions to remediate this vulnerability. No additional mitigation guidance is provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- PostgreSQL
- Date Reserved
- 2026-07-03T20:28:17.298Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a7dc617bf8831d5393e53a7
Added to database: 08/13/2026, 13:26:47 UTC
Last enriched: 09/13/2026, 13:04:37 UTC
Last updated: 09/28/2026, 13:47:42 UTC
Views: 51
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.