CVE-2026-14678: PostgreSQL pg_trgm picksplit reads past end of buffer
Buffer over-read in PostgreSQL pgtrgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQL pg_trgmto a version that resolves this vulnerability.Fixed in 18.5 - Upgrade
Upgrade
PostgreSQL pg_trgmto a version that resolves this vulnerability.Fixed in 17.11 - Upgrade
Upgrade
PostgreSQL pg_trgmto a version that resolves this vulnerability.Fixed in 16.15 - Upgrade
Upgrade
PostgreSQL pg_trgmto a version that resolves this vulnerability.Fixed in 15.19 - Upgrade
Upgrade
PostgreSQL pg_trgmto a version that resolves this vulnerability.Fixed in 14.24
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14678?
The severity of CVE-2026-14678 is medium with a score of 4.3.
How do I fix CVE-2026-14678?
To fix CVE-2026-14678, upgrade to PostgreSQL versions 18.5, 17.11, 16.15, 15.19, or 14.24 or later.
What type of vulnerability is CVE-2026-14678?
CVE-2026-14678 is a buffer over-read vulnerability in the PostgreSQL pg_trgm index picksplit function.
Who is affected by CVE-2026-14678?
Versions of PostgreSQL prior to 18.5, 17.11, 16.15, 15.19, and 14.24 are affected by CVE-2026-14678.
What impact does CVE-2026-14678 have?
CVE-2026-14678 may allow a table maintainer to infer limited memory values due to reading past the end of a buffer.