CVE-2026-62349: TDengine Database RCE Vulnerability

CVE-2026-62349 Overview

CVE-2026-62349 is a stack-based buffer overflow [CWE-121] in TDengine, an open source time-series database optimized for Internet of Things (IoT) workloads. The flaw exists in the trimString() function within source/libs/parser/src/parUtil.c. When parsing SQL string escape sequences such as \%, \_, or \x, the function checks available space for only one byte before writing, enabling a one-byte out-of-bounds write to the stack buffer tmpTokenBuf. An authenticated attacker sending crafted SQL over the network can trigger denial of service and potentially remote code execution. The issue affects TDengine 3.4.1.6 and earlier and is fixed in 3.4.1.14.

Critical Impact
A single crafted SQL statement can corrupt the stack of the TDengine parser, leading to service crash and potential code execution on database nodes.

Affected Products

TDengine versions 3.4.1.6 and earlier
TDengine cluster nodes exposing SQL query endpoints
IoT deployments relying on TDengine for time-series ingestion

Discovery Timeline

2026-07-15 - CVE-2026-62349 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-62349

Vulnerability Analysis

The vulnerability resides in the SQL parser utility trimString() in source/libs/parser/src/parUtil.c. TDengine uses this function to normalize SQL string literals before further parsing, including handling backslash escape sequences. During escape processing, the function must copy the escaped byte plus a substitution byte into the destination buffer tmpTokenBuf, which is allocated on the stack.

The bounds check accounts for only a single byte of remaining space, while the escape handling for \%, \_, and \x writes an additional byte beyond the intended limit. This yields an off-by-one write past the end of the fixed-size stack buffer. The corrupted stack region can overwrite adjacent local variables, saved frame pointers, or return addresses depending on compiler layout and stack canary configuration.

Root Cause

The root cause is an incorrect boundary check preceding a multi-byte write. The function reserves capacity for one byte but proceeds to emit two bytes when translating specific escape sequences. This mismatch between the validated length and the write length is a classic off-by-one condition classified under [CWE-121] Stack-based Buffer Overflow.

Attack Vector

Exploitation requires network access to the TDengine SQL interface and low-privileged authenticated credentials. An attacker submits a crafted SQL statement containing a string literal that terminates precisely at the buffer boundary with a \%, \_, or \x escape. Parsing the statement causes the one-byte overflow. Repeated exploitation reliably crashes the service, and stack layout manipulation may allow attackers to influence execution flow on the parser process.

No verified public proof-of-concept code is available. See the GitHub Security Advisory for vendor technical details.

Detection Methods for CVE-2026-62349

Indicators of Compromise

Unexpected crashes or restarts of taosd processes correlated with client SQL activity
Core dumps referencing trimString or parUtil.c frames in the call stack
Malformed SQL statements in query logs containing dense sequences of \%, \_, or \x escapes at string boundaries
Abnormal spikes in parser errors originating from a single authenticated account

Detection Strategies

Monitor TDengine query logs for statements with unusual escape patterns targeting the maximum token length
Alert on repeated taosd process termination signals such as SIGSEGV or SIGABRT
Deploy runtime memory safety instrumentation (AddressSanitizer builds) in staging to detect off-by-one writes
Correlate authentication events with subsequent service failures to identify abusive accounts

Monitoring Recommendations

Enable verbose SQL audit logging on TDengine nodes and forward to a centralized log platform
Track process uptime and crash counters for all taosd instances with alerts on regression
Baseline normal SQL syntax patterns per application and flag deviations involving heavy backslash escapes
Review network telemetry for TDengine port access from unexpected client identities

How to Mitigate CVE-2026-62349

Immediate Actions Required

Upgrade all TDengine deployments to version 3.4.1.14 or later without delay
Restrict network access to TDengine SQL endpoints to trusted application hosts only
Rotate and audit database credentials to remove unused low-privileged accounts
Review recent SQL audit logs for evidence of exploitation attempts against trimString()

Patch Information

The TDengine maintainers fixed CVE-2026-62349 in version 3.4.1.14. The corrected trimString() implementation validates sufficient buffer space for the full multi-byte escape substitution before writing. Refer to the TDengine GHSA-4v5h-fxjw-vrmq advisory for the official patch details and version guidance.

Workarounds

Place TDengine behind an application-layer proxy that rejects SQL containing dense escape sequences until patching is complete
Enforce least-privilege database roles so that only vetted service accounts can submit arbitrary SQL
Isolate TDengine nodes on segmented networks with strict firewall rules limiting client sources
Enable operating system stack protections such as stack canaries, ASLR, and non-executable stacks on database hosts

bash

# Upgrade TDengine to the patched release
systemctl stop taosd
wget https://www.taosdata.com/assets-download/3.0/TDengine-server-3.4.1.14-Linux-x64.tar.gz
tar -xzf TDengine-server-3.4.1.14-Linux-x64.tar.gz
cd TDengine-server-3.4.1.14 && ./install.sh -e no
systemctl start taosd
taos -s "SELECT server_version();"