CVE-2026-14678
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A buffer over-read vulnerability was found in PostgreSQL's pg_trgm index picksplit function, which reads past the end of a heap buffer. This might allow a table maintainer to infer limited memory values via the lossy signal of index split choices. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Risk Assessment
The risk includes potential disclosure of memory fragments, which may lead to leakage of sensitive data or facilitate further attacks.
Recommendation
Upgrade PostgreSQL to a patched version and restrict index management privileges to trusted administrators only.
Original NVD description (English source)
Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.