CVE-2026-14668

⚠️ high

Summary

Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS Score

8.1

High

EPSS Score

0.3

Exploit Probability

Published Date

2026-08-13

First Seen: 2026-08-14

📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 76.8% of all 349,476 vulnerabilities in our database.

#80,948

Top 25% most severe

Severity Percentile

🎯 CISA SSVC Assessment Updated: Aug 13, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

The PostgreSQL project thanks Hcamael for reporting this problem.

SSVC data provided by CISA

Last Modified 2026-08-19

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE IDs (Weakness Types)

CWE-843

📦 Affected Products 5

Vendor	Product	Status	Affected Versions
postgresql	postgresql	Affected	> 14.0 < 14.24
postgresql	postgresql	Affected	> 15.0 < 15.19
postgresql	postgresql	Affected	> 16.0 < 16.15
postgresql	postgresql	Affected	> 17.0 < 17.11
postgresql	postgresql	Affected	> 18.0 < 18.5

🔗 References 1

https://www.postgresql.org/support/security/CVE-2026...

Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-14662	⚠️ high	8.8	0.5	Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause ...	2026-08-13
CVE-2026-14663	🔶 medium	6.5	0.1	Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of ...	2026-08-13
CVE-2026-14664	⚠️ high	8.8	0.4	Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user...	2026-08-13
CVE-2026-14666	🔶 medium	4.2	0.2	Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query ...	2026-08-13
CVE-2026-14669	⚠️ high	8.8	0.6	Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code...	2026-08-13
CVE-2026-14670	⚠️ high	8.8	0.4	Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as t...	2026-08-13

These CVEs affect the same products