CVE-2026-14678
Public on 2026-08-13
Modified on 2026-08-15
Description
Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2 - Postgresql14 Extra | libpq | Not Affected | ||
| Amazon Linux 2023 | libpq | Not Affected | ||
| Amazon Linux 2 - Core | postgresql | Pending Fix | ||
| Amazon Linux 2 - Postgresql14 Extra | postgresql | Pending Fix | ||
| Amazon Linux 2 - Postgresql10 Extra | postgresql | No Fix Planned | ||
| Amazon Linux 2 - Postgresql11 Extra | postgresql | No Fix Planned | ||
| Amazon Linux 2 - Postgresql12 Extra | postgresql | No Fix Planned | ||
| Amazon Linux 2 - Postgresql13 Extra | postgresql | No Fix Planned | ||
| Amazon Linux 2 - Postgresql9.6 Extra | postgresql | No Fix Planned | ||
| Amazon Linux 2023 | postgresql15 | Pending Fix | ||
| Amazon Linux 2023 | postgresql16 | Pending Fix | ||
| Amazon Linux 2023 | postgresql17 | Pending Fix | ||
| Amazon Linux 2023 | postgresql18 | Pending Fix |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |