Loading vulnerability…
Information disclosure in PostgreSQL ctid selectivity estimator
CVE-2026-14668 is a type-confusion vulnerability in PostgreSQL's ctid data-type selectivity estimator. A database user with object-creation privileges can supply a chosen non-ctid input and observe a calculation derived from the value of an arbitrary four-byte span of server memory. Although the calculation loses precision, substantial recovery of memory values appears possible. Affected release branches include PostgreSQL versions before 18.6, 17.11, 16.15, 15.19, and 14.24.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can disclose information derived from arbitrary four-byte spans of database-server memory, potentially exposing sensitive in-memory data to a low-privileged database user. Precision loss limits exact recovery from an individual calculation but does not prevent substantial memory-value recovery. The vulnerability-specific CVSS assessment rates confidentiality and availability impacts as high and integrity impact as none; a specific availability-failure mechanism is not established.
If you can’t patch tonight, do this now.
Until patched, restrict database object-creation privileges to trusted administrators and limit untrusted users' access to affected instances. Restrict network access to trusted clients and monitor anomalous SQL and object-creation activity. These measures reduce exposure but do not replace the security update.
Patch, then assume compromise.
Upgrade to PostgreSQL 18.6, 17.11, 16.15, 15.19, or 14.24 or later within the applicable release branch, or install the distribution's security-fixed PostgreSQL packages. Restart PostgreSQL after package updates so the fixed server binaries take effect. Migrate unsupported releases to a supported, patched release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
71 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.