Description

Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-13T13:17:45.150Z",
  "pubdate": "2026-08-13T13:17:45.150Z",
  "executiveSummary": "A buffer over-read vulnerability exists in the pg_trgm extension of PostgreSQL, specifically within the index picksplit function. This flaw allows a privileged user acting as a table maintainer to read past the allocated boundaries of a heap buffer during index page splitting operations. The primary impact is limited information disclosure, where an attacker can infer sensitive memory contents based on the lossy signal produced by index split choices. Affected software includes PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24. Exploitation requires specific privileges associated with table maintenance roles within the database management system, making internal threat modeling a primary risk consideration. The vulnerability stems from improper bounds checking within the trigram indexing routines when processing heap buffers during generalized search tree (GiST) or Generalized Inverted Index (GIN) index maintenance tasks.",
  "technicalDetails": "The vulnerability resides in the pg_trgm index picksplit function, a core component responsible for partitioning trigram index tuples during index construction and maintenance operations. The root cause is an out-of-bounds read condition where the function reads past the designated end of a heap buffer. During the execution of the picksplit routine, the algorithm evaluates data elements to determine optimal partitioning strategies for tree balancing. Due to insufficient validation of buffer boundaries and input length calculations, the memory read operation extends beyond the allocated heap buffer boundary.\nExploitation occurs when an authenticated database user with table maintenance privileges triggers index creation, reindexing, or heavy data insertion workflows that invoke the pg_trgm picksplit function. While arbitrary code execution is not directly facilitated by a buffer over-read, the attacker leverages a side-channel mechanism. By analyzing the lossy signals generated by the resulting index split choices and structural variations in the index, the user can selectively infer the contents of adjacent memory addresses residing immediately past the affected heap buffer.\nThe attack flow proceeds as follows: First, the attacker establishes a connection to the PostgreSQL database with permissions sufficient to alter or maintain tables utilizing pg_trgm indexes. Second, the attacker issues commands that force index page splitting operations, such as inserting manipulated textual data or invoking REINDEX. Third, the pg_trgm picksplit function processes the input strings, executing out-of-bounds reads on adjacent heap memory. Fourth, the attacker observes the timing, behavior, or metadata resulting from the split decisions. Finally, by correlating these observations, the attacker infers limited values from the leaked memory contents. Authentication is required, network exposure depends on standard database connectivity rules, and the necessary privileges correspond to those of a table maintainer."
}