CVE-2026-14668
High · 8.1CVSS
8.1
EPSS
0.3%
Published
Aug 13, 2026
CISA due date
—
The record
Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-109282 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in… CWE-843
- CVE-2026-106587 In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes… CWE-843
- CVE-2026-106446 Handlebars provides the power necessary to let users build semantic templates. CWE-843
- CVE-2026-101912 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in… CWE-843
- CVE-2026-15461 The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later… CWE-843
- CVE-2026-87636 Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker… CWE-843
- CVE-2026-87612 Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to… CWE-843
- CVE-2026-87564 Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to… CWE-843