Loading vulnerability…
Heap buffer over-read in PostgreSQL pg_trgm index picksplit
CVE-2026-14678 is a heap buffer over-read in the index picksplit function of PostgreSQL's pg_trgm extension. The function reads beyond the end of an allocated heap buffer, potentially influencing index split decisions with out-of-bounds memory values. A table maintainer may infer limited process-memory values by observing those decisions, which provide a lossy disclosure channel. Affected releases include PostgreSQL 14 before 14.24, 15 before 15.19, 16 before 16.15, 17 before 17.11, and 18 before 18.6.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated table maintainer may infer limited PostgreSQL process-memory values through index split choices. Disclosure is indirect and lossy, rather than an unrestricted memory-read capability. The CVSS v3.1 score is 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), indicating low confidentiality impact and no identified integrity or availability impact.
If you can’t patch tonight, do this now.
Until patched, restrict table-maintenance privileges to trusted roles and limit untrusted users' ability to create or manipulate pg_trgm indexes. Restrict database access to trusted users and networks as an additional exposure-reduction measure.
Patch, then assume compromise.
Upgrade to PostgreSQL 18.6, 17.11, 16.15, 15.19, or 14.24 or later in the corresponding major-version branch, or install the distribution's security-fixed packages. Some advisories identify 18.5 as fixed, while others specify 18.6; selecting 18.6 or later avoids this discrepancy. Restart PostgreSQL after package updates so the patched code takes effect.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.