Quick answers
- Is CVE-2026-62349 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-62349 being exploited in the wild.
- How severe is CVE-2026-62349?
- High severity, with a CVSS score of 8.3, published 15 July 2026.
- Which products and versions are affected?
- TAOS Data TDengine <= 3.4.1.6.
- Is there a fix for CVE-2026-62349?
- A patch was published on 2026-07-15: Fix confirmed in version 3.4.1.14 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-62349 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-62349?
- Check whether you run TAOS Data TDengine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stack-based buffer overflow exists in TDengine versions 3.4.1.6 and earlier within the `trimString()` function located in `source/libs/parser/src/parUtil.c`. The vulnerability is an off-by-one error where the function validates space for only one byte before writing two bytes when processing SQL string escape sequences (`\%`, `\_`, or `\x`). An attacker with the ability to execute SQL queries can trigger a one-byte out-of-bounds write to the `tmpTokenBuf` stack buffer. This can result in stack corruption, leading to a denial of service (crash) or potentially remote code execution (RCE) by overwriting adjacent memory or return addresses. The issue is fixed in version 3.4.1.14.
Affected products
- taosdata TDengine <= 3.4.1.6
Timeline
- 2026-06-26: advisory: GitHub advisory published by vendor
- 2026-07-15: disclosed: NVD publication date
- 2026-07-15: patched: Fix confirmed in version 3.4.1.14