Executive brief
TrailDB is a database tool for storing and querying time-series event data. A vulnerability in how TrailDB opens and validates database files allows an attacker to craft a malicious database file that crashes tools reading from it, disrupting service availability and potentially exposing systems to denial-of-service attacks.
Technical details
TrailDB 0.6 contains an out-of-bounds read vulnerability in the tdb_open() function within /src/tdb.c. The vulnerability exists in the TOC (Table of Contents) validation: the code maps trails.toc and trails.data files into memory but fails to verify that TOC offsets lie within the bounds of trails.data, that the TOC contains enough entries for the declared number of trails, or that offsets are monotonically increasing. An attacker can craft a malicious .tdb file with a small trails.data file and set TOC entries to large values (e.g., 0xffffffff). When tdb_get_trail() later reads these attacker-controlled offsets and constructs pointers into memory, it triggers an out-of-bounds read in the read_bits() decoder, causing a crash. The attack is network-accessible if the application accepts .tdb files from untrusted sources; no authentication or user interaction is required beyond opening the file.
Affected products
- TrailDB TrailDB 0.6
Timeline
- 2026-06-29: disclosed: Security issue reported on GitHub
- 2026-08-16: advisory: CVE-2026-19955 published
- 2026-08-16: other: Exploit is public; vendor has not responded to early notification