TDengine’s SQL lexer function tGetToken increments past a trailing backslash in a string literal, such as 'abc\\', causing a read one byte beyond the string’s null terminator. This out‑of‑bounds read permits an authenticated user who can submit arbitrary SQL statements to crash the database server and, potentially, leak the contents of adjacent memory. The vulnerability does not provide remote code execution but raises risks of denial of service and data leakage for users with write access to the database.

The vulnerability affects the taosdata TDengine time‑series database. All installations running versions prior to 3.4.1.14 are impacted; the fix is included in 3.4.1.14 and later releases.

The CVSS score of 5.4 reflects a moderate severity, and the EPSS score of less than 1% indicates that real‑world exploitation is expected to be rare. The issue is not listed in CISA’s KEV catalog. Attackers require authenticated access to submit SQL commands, so only users with database privileges can trigger the crash. Once a target has the ability to run SQL, they could craft a malformed string literal to induce the out‑of‑bounds read and watch for crashes or memory disclosure. While the exploitation path is straightforward, the low probability of widespread use keeps the overall risk moderate.