This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-14668 →

DEBIAN-CVE-2026-14668

Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the valu...

Original description

The description as published by the source.

Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 postgresql-15

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.19-0+deb12u1"}]}]

Debian:13 postgresql-17

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.11-0+deb13u1"}]}]

Debian:14 postgresql-18

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1"}]}]

References

advisory security-tracker.debian.org