medium CVSS 4.3 EPSS 0.20%

CVE-2026-14678·PostgreSQL vulnerability

Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity
medium
Software
PostgreSQL
Fixed in
18.5
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.20% — higher than 8% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

From: 18.0

Until: 18.5

Fixed in: 18.5

How to fix this CVE

Update PostgreSQL to version 18.5 or later to patch the buffer over-read vulnerability in the pg_trgm index picksplit function. This memory disclosure issue could allow database maintainers with elevated privileges to infer sensitive heap memory contents through careful observation of index split behavior. Apply the update during a maintenance window and restart the PostgreSQL service to fully remediate the issue.

sudo dnf update postgresql-server postgresql-libs

Defensia detects this vulnerability

How to check if you are affected

  1. Check PostgreSQL version: psql --version or SELECT version(); in psql client
  2. Verify pg_trgm extension is installed: SELECT * FROM pg_extension WHERE extname = 'pg_trgm'; in psql
  3. Search PostgreSQL logs for index maintenance operations: grep -i 'picksplit\|trgm' /var/log/postgresql/*.log
  4. Confirm patch applied: psql -c 'SELECT version();' and verify output shows 18.5 or later

FAQ

What is CVE-2026-14678?

CVE-2026-14678 is a buffer over-read vulnerability in PostgreSQL's pg_trgm trigram index implementation. The picksplit function can read beyond heap buffer boundaries, potentially exposing sensitive memory values through the pattern of index split decisions made by database maintainers.

Is CVE-2026-14678 being actively exploited?

No, this vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and no public exploits are currently available. However, it should still be patched promptly as it poses a risk to data confidentiality in multi-tenant environments.

What versions of PostgreSQL are affected by CVE-2026-14678?

PostgreSQL 18.0 through 18.4 are affected. Fixed versions include 18.5, 17.11, 16.15, 15.19, and 14.24. Users on older versions within these series should upgrade immediately.

How do I check if my server is vulnerable to CVE-2026-14678?

Run `psql -c 'SELECT version();'` to check your PostgreSQL version. If it reports a version between 18.0 and 18.4, your instance is vulnerable. Also verify pg_trgm is loaded with `SELECT * FROM pg_extension WHERE extname = 'pg_trgm';`

Does Defensia detect CVE-2026-14678?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-14678 will appear in your dashboard with remediation steps.

Related PostgreSQL CVEs

CVE-2026-14671CVSS 8.8Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14680CVSS 8.8Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14677CVSS 8.8Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14676CVSS 8.8Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.
CVE-2026-15741CVSS 8.8SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-14678. Free for 1 server.

Get started free