CVE-2026-62349: TDengine: Off-by-One Buffer Overflow

Severity: high (CVSS 8.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-15 · updated 2026-10-24
Weakness: CWE-121

Description

TDengine is an open source, time-series database optimized for Internet of Things devices. In 3.4.1.6 and earlier, source/libs/parser/src/parUtil.c trimString() checks space for only one byte before processing SQL string escape sequences \%, \_, or \x, allowing a one-byte out-of-bounds write to the stack buffer tmpTokenBuf that can cause denial of service and potentially remote code execution. This issue is fixed in version 3.4.1.14.

Affected products

taosdata TDengine: before 3.4.1.14

References

https://github.com/taosdata/TDengine/security/advisories/GHSA-4v5h-fxjw-vrmq
https://github.com/taosdata/TDengine/security/advisories/GHSA-4v5h-fxjw-vrmq

Get alerted when CVE-2026-62349 or the next vulnerability affects your stack