An out-of-bounds read vulnerability in TimescaleDB allows authenticated attackers to potentially disclose sensitive information via manipulated dictionary compression operations.

This vulnerability involves improper validation of array indices (CWE-129) and out-of-bounds read (CWE-125). An attacker with low-level privileges can trigger this flaw during dictionary compression reverse iterator operations.

While the vulnerability requires authenticated access, a successful exploit could result in the unauthorized disclosure of sensitive data residing in memory. The CVSS score of 8.1 reflects the potential for serious information leakage within the database environment, which could have significant privacy and compliance implications for organizations handling sensitive datasets.

Immediate Action: Update to the latest version of TimescaleDB or apply the fix found in commit 517c13e7cc6afadb4a7deaa7a5a5a29065e5b5a3.

Proactive Monitoring: Monitor database query performance and audit logs for unusual errors or attempts to access compressed data structures that might indicate exploitation.

Compensating Controls: Enforce the principle of least privilege by restricting database access to only necessary users and applications to prevent unauthorized exploitation of the flaw.

Public Exploit Available: Unknown.

Database administrators should plan for an immediate update to remediate this out-of-bounds read vulnerability. Ensuring that the database engine is running an unaffected version is essential to maintaining the confidentiality of stored data and preventing low-privilege users from escalating their impact.