CVE-2026-14668

This is not a typical SQL injection or privilege escalation vulnerability. The ctid selectivity estimator bug exploits a gap between PostgreSQL's type system and its internal memory layout: the function accepts generic input but processes it using ctid's internal memory representation, exposing raw 4-byte memory spans to any user who can create objects in the database. The practical impact depends on what those 4 bytes are part of—and that matters more than the precision loss itself. PostgreSQL doesn't scatter memory randomly; the planner heap contains tuple visibility markers, catalog entries, session parameters, and compiled query structures. A 4-byte read from planner state isn't reading noise—it's reading structured metadata that can serve as anchors for further exploitation, potentially including pointers, catalog references, or session tokens. The advisory's 'precision loss' phrasing obscures whether this is lossy floating-point conversion or partial struct exposure, but either way, the bounded and predictable nature of PostgreSQL's memory topology undermines any assumption that the precision limitation blocks practical exploitation. The 'object creator' prerequisite sounds narrow, but in modern deployments it's not: application service accounts routinely have schema creation rights, ORMs generate objects dynamically, migration scripts run under elevated contexts, and CI/CD pipelines hold object creation privileges. A compromised application account, a malicious developer with staging access, or a supply-chain-compromised deployment tool all satisfy this prerequisite. The blast radius extends to any deployment where the application and database share a trust relationship—which is the architectural default. Treat this as a planner-state information leak that enables reconnaissance for subsequent attacks, not as a constrained data exposure. Prioritize patching across all affected branches, and audit which roles in your deployment hold object creation privileges—these represent your actual attack surface.

Reviewed through automated stages and approved by a human before publication.