CVE-2026-14668 - PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read

First Published: 2026/08/13

Important: This assessment evaluates the impact of CVE-2026-14668 on EDB products and services. It links to and details the CVE and supplements that information with EDB's own assessment.

Summary

Type confusion in the PostgreSQL ctid data type's selectivity estimator allows an object creator to view a calculation derived from arbitrary 4-byte spans of server memory via non-ctid inputs. The recovered value loses precision, but substantial memory-content recovery is possible over repeated queries. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Vulnerability details

CVE-ID: CVE-2026-14668

CVE Publish Date: 2026/08/13

CVSS Base Score: 8.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Affected products and versions

PostgreSQL

  • All versions prior to 18.5
  • All versions prior to 17.11
  • All versions prior to 16.15
  • All versions prior to 15.19
  • All versions prior to 14.24

EnterpriseDB Postgres Advanced Server (EPAS)

  • All versions prior to 18.5
  • All versions prior to 17.11
  • All versions prior to 16.15
  • All versions prior to 15.19
  • All versions prior to 14.24

EnterpriseDB Postgres Extended (PGE)

  • All versions prior to 18.5
  • All versions prior to 17.11
  • All versions prior to 16.15
  • All versions prior to 15.19
  • All versions prior to 14.24

CloudNativePG

  • All operand versions prior to 18.5
  • All operand versions prior to 17.11
  • All operand versions prior to 16.15
  • All operand versions prior to 15.19
  • All operand versions prior to 14.24

WarehousePG

  • All 6.x versions up to and including 6.27.5
  • All 7.x versions up to and including 7.5.0

Remediation/fixes

PostgreSQL

Affected VersionFixed InFix Published
prior to 18.518.52026-08-13
prior to 17.1117.112026-08-13
prior to 16.1516.152026-08-13
prior to 15.1915.192026-08-13
prior to 14.2414.242026-08-13

EDB Postgres Extended Server

Affected VersionFixed InFix Published
prior to 18.518.52026-08-13
prior to 17.1117.112026-08-13
prior to 16.1516.152026-08-13
prior to 15.1915.192026-08-13
prior to 14.2414.242026-08-13

EDB Postgres Advanced Server

Affected VersionFixed InFix Published
prior to 18.518.52026-08-13
prior to 17.1117.112026-08-13
prior to 16.1516.152026-08-13
prior to 15.1915.192026-08-13
prior to 14.2414.242026-08-13

CloudNativePG

Customer should update to the fixed version of the PostgreSQL operands.

WarehousePG

Fixes will be included in the next minor release of WarehousePG 6.x and 7.x.

References

Acknowledgement

Source: PostgreSQL.org


Could this page be better? Report a problem or suggest an addition!