CVE-2026-14678

A flaw was found in PostgreSQL. A buffer over-read vulnerability exists in the pg_trgm index picksplit function, which reads past the end of a heap buffer. This could allow a table maintainer to infer limited memory values by observing index split choices, leading to information disclosure.

This Moderate impact information disclosure flaw in PostgreSQL's pg_trgm extension requires a table maintainer to exploit, limiting the attack surface to privileged database users. Successful exploitation allows for the inference of limited memory values through index split choices.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict PostgreSQL to trusted clients. If trigram indexes are unused, drop the extension (DROP EXTENSION pg_trgm) so gtrgm_picksplit cannot run. Limit CREATE INDEX and table-owner rights on databases that use gist_trgm_ops to trusted roles.