CVE-2026-62350
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
In TDengine prior to version 3.4.1.15, a user with create UDF privilege can upload a crafted shared library and install it as a user-defined function, then execute arbitrary C code on the server side through database queries.
Risk Assessment
The risk involves authenticated users being able to execute arbitrary code on the database server, potentially leading to full system compromise, data exfiltration, or service disruption.
Recommendation
Immediately upgrade TDengine to version 3.4.1.15 or later, which contains the fix for this vulnerability.
Other vulnerabilities in TDengine
See all- CVE-2026-62355Medium
In TDengine prior to version 3.4.1.15, a Data Reader user with admin_user role on a TDengine Cloud DB instance could execute create udf, even though standard users should have read-only permissions for non-database objects and commands like show dnodes and create user were denied.
- CVE-2026-62353Medium
In TDengine before version 3.4.1.14, the tGetToken() function in the SQL parser mishandles string literals ending with a backslash, causing an out-of-bounds read. An authenticated user can submit a crafted SQL query to crash the server and potentially leak adjacent memory.
- CVE-2026-62351High
In TDengine before version 3.4.1.15, the transDecompressMsg() function reads the STransCompMsg.contLen field without first validating that the RPC packet contains the 8-byte STransCompMsg structure, leading to an unauthenticated out-of-bounds read, uncontrolled allocation, integer underflow, and server crash.
- CVE-2026-62349High
In TDengine version 3.4.1.6 and earlier, the trimString() function in parUtil.c incorrectly checks string length before processing SQL escape sequences, leading to a one-byte out-of-bounds write to the stack buffer tmpTokenBuf. This can cause denial of service and potentially remote code execution.
- CVE-2026-62348Medium
In TDengine Enterprise before version 3.4.1.15, an authenticated low-privilege SQL user could run KILL SSMIGRATE <id> against an active shared-storage migration because the MND_OPER_SSMIGRATE_DB privilege check was commented out in mndProcessKillSsMigrateReq.
- CVE-2026-42542High
TDengine versions 3.4.0.0 through 3.4.1.5 allow an unauthenticated remote attacker to crash the taosd server process by sending a single crafted RPC packet. The issue is fixed in version 3.4.1.6.
Original NVD description (English source)
TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a user with create udf privilege could upload a crafted shared library and install it as a user-defined function, such as eval, then execute arbitrary C code on the TDengine server side through database queries. This issue is fixed in version 3.4.1.15.