Vulnerability · Published Jul 15, 2026 · Assigned by GitHub_M

CVE-2026-62349TDengine: Off-by-One Buffer Overflow

High 8.3

In plain English

A high-severity stack buffer overflow in TDengine from taosdata. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.5%top 57.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

TDengine is an open source, time-series database optimized for Internet of Things devices. In 3.4.1.6 and earlier, source/libs/parser/src/parUtil.c trimString() checks space for only one byte before processing SQL string escape sequences \%, \_, or \x, allowing a one-byte out-of-bounds write to the stack buffer tmpTokenBuf that can cause denial of service and potentially remote code execution. This issue is fixed in version 3.4.1.14.

Affected products (as reported)

Vendor	Product	Versions
taosdata	TDengine	< 3.4.1.14

Weakness: CWE-121, CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

References

https://github.com/taosdata/TDengine/security/advisories/GHSA-4v5h-fxjw-vrmq x_refsource_CONFIRM