TimescaleDB versions up to 2.29.1 contain an out-of-bounds read vulnerability in the dictionary compression reverse row iterator component (tsl/src/compression/algorithms/dictionary.c). While the forward path validates the decoded index, the reverse path uses an assertion that is omitted in release builds, leaving the 64-bit Simple8b index unchecked. An attacker with DML privileges on a physical compressed relation can insert crafted data and perform a reverse-order scan, causing an out-of-bounds Datum to be returned to the client. This results in disclosure of backend memory, including the shared buffer pool, bypassing SQL access control. The vulnerability is tracked as CVE-2026-70634 and has a CVSS 4.0 score of 7.2 (high severity). No official patch or remediation level is currently stated in the vendor advisory or data provided.

An attacker with data manipulation language (DML) access to a physical compressed relation in TimescaleDB can exploit this vulnerability to read out-of-bounds memory from the backend process. This memory disclosure can leak sensitive information such as contents of the shared buffer pool. The vulnerability bypasses SQL access controls because the out-of-bounds data is returned as a normal column value in query results. This could lead to unauthorized data exposure within the database environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict DML access to physical compressed relations to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.