CVE-2026-62349 Details
Description
TDengine is an open source, time-series database optimized for Internet of Things devices. In 3.4.1.6 and earlier, source/libs/parser/src/parUtil.c trimString() checks space for only one byte before processing SQL string escape sequences \%, \_, or \x, allowing a one-byte out-of-bounds write to the stack buffer tmpTokenBuf that can cause denial of service and potentially remote code execution. This issue is fixed in version 3.4.1.14.
A stack buffer overflow vulnerability has been identified in TDengine versions through 3.4.1.6. The issue arises in the `trimString()` function within the SQL parser, where the function improperly handles escape sequences in string literals. This flaw allows a one-byte out-of-bounds write to a stack buffer, potentially leading to stack corruption. The vulnerability can cause a denial-of-service condition and may be exploitable for remote code execution. The issue has been addressed in TDengine version 3.4.1.14.
Users can upgrade to TDengine version 3.4.1.14 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/taosdata/TDengine/security/advisories/GHSA-4v5h-fxjw-vrmq | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/taosdata/TDengine/security/advisories/GHSA-4v5h-fxjw-vrmq | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TDengine | <= 3.4.1.6 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |