CVE-2026-14668

HighCVSS 8.1/10Last modified Aug 29, 2026

Description

Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-843

Affected software

No affected versions have been published.

Timeline

Published: Aug 13, 2026
Last modified: Aug 29, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-146698.8Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating sy CVE-2026-14675.3A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an CVE-2026-146708.8Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system CVE-2026-146718.8Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the dat CVE-2026-146725.3Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observ CVE-2026-146733.8Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the own CVE-2026-146768.8Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running CVE-2026-146778.8Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation a CVE-2026-146784.3Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to inf CVE-2026-146798.2Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The CVE-2026-14685.1QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by CVE-2026-146808.8Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running