Executive brief
TDengine is an open-source database designed for Internet of Things (IoT) devices to handle large amounts of time-series data. A security flaw in how the database processes specific database commands (SQL strings) allows an attacker to crash the system or potentially gain unauthorized control over the server. This could lead to service outages or the theft of sensitive data stored within the database.
Technical details
A stack-based buffer overflow exists in TDengine versions 3.4.1.6 and earlier within the `trimString()` function located in `source/libs/parser/src/parUtil.c`. The vulnerability is an off-by-one error where the function validates space for only one byte before writing two bytes when processing SQL string escape sequences (`\%`, `\_`, or `\x`). An attacker with the ability to execute SQL queries can trigger a one-byte out-of-bounds write to the `tmpTokenBuf` stack buffer. This can result in stack corruption, leading to a denial of service (crash) or potentially remote code execution (RCE) by overwriting adjacent memory or return addresses. The issue is fixed in version 3.4.1.14.
Affected products
- taosdata TDengine <= 3.4.1.6
Timeline
- 2026-06-26: advisory: GitHub advisory published by vendor
- 2026-07-15: disclosed: NVD publication date
- 2026-07-15: patched: Fix confirmed in version 3.4.1.14