BIT-postgresql-2026-14668

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/postgresql/BIT-postgresql-2026-14668.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-postgresql-2026-14668

Aliases

CVE-2026-14668

Published

2026-08-19T08:52:33Z

Modified

2026-09-08T08:47:41Z

Summary

PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read

Details

Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Database specific

{
    "cpes": [
        "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}

References

Affected packages

Bitnami / postgresql

Package

Name: postgresql
Purl: pkg:bitnami/postgresql

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

14.24.0

Introduced

15.0.0

Fixed

15.19.0

Introduced

16.0.0

Fixed

16.15.0

Introduced

17.0.0

Fixed

17.11.0

Introduced

18.0.0

Fixed

18.5.0

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/postgresql/BIT-postgresql-2026-14668.json"