Vulnerability · Published Jul 15, 2026 · Assigned by GitHub_M

CVE-2026-62353TDengine: Authenticated Out-of-Bounds Read in SQL Lexer tGetToken

Medium 5.4

In plain English

A medium-severity out-of-bounds read in TDengine from taosdata. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.4%top 68.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incremented past a trailing backslash in a SQL string literal such as 'abc\ and read one byte beyond the null terminator, allowing an authenticated user who can submit SQL queries to crash the server and possibly leak adjacent memory. This issue is fixed in version 3.4.1.14.

Affected products (as reported)

Vendor	Product	Versions
taosdata	TDengine	< 3.4.1.14

Weakness: CWE-125, CWE-126 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

References

https://github.com/taosdata/TDengine/security/advisories/GHSA-5r9p-3j4f-gmgp x_refsource_CONFIRM