CVE-2026-14668

A flaw was found in PostgreSQL. This vulnerability, stemming from a type confusion issue in the ctid data type selectivity estimator, could allow an authenticated object creator to access and potentially recover sensitive information from memory. By manipulating input, an attacker could gain unauthorized insight into system memory.

An Important-rated information disclosure vulnerability in PostgreSQL allows an authenticated user with object creation privileges to read arbitrary memory spans. By exploiting a type confusion flaw within the ctid selectivity estimator, an attacker can view memory-derived calculations to recover sensitive data. Exploitation is limited to users possessing object creation rights

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, administrators should enforce the principle of least privilege by revoking CREATE permissions on all databases from untrusted users. Because exploiting this flaw strictly requires the attacker to be an object creator, removing this privilege effectively neutralizes the threat. Ensure only highly trusted administrative roles can create database objects