Threats Tagged 'cve-2026-14678'

This security update for PostgreSQL 18 addresses multiple vulnerabilities affecting various components such as psql, logical decoding, pgcrypto, regexp, and others. The issues include heap buffer overflows that can lead to arbitrary code execution, type confusion, integer wraparound causing undersize allocations, privilege enforcement failures, and SQL injection risks. The update fixes these vulnerabilities to improve the security and stability of PostgreSQL 18 and related versions.

Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

CVE-2026-14678 is a buffer over-read vulnerability in the pg_trgm index picksplit function of PostgreSQL. This flaw allows reading past the end of a heap buffer, potentially enabling a table maintainer to infer limited memory values through index split behavior. The vulnerability affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The CVSS score is 4.3, indicating medium severity.