TimescaleDB versions up to 2.29.1 contain an out-of-bounds read in the dictionary-compression reverse row iterator. The reverse path omits validation of the 64-bit Simple8b index, allowing an attacker to control the read offset. When a catalog entry is stored with a pass-by-value column type, the out-of-bounds Datum is returned to the client as a normal column value, exposing memory from the backend, including the shared buffer pool, which is not protected by normal SQL access control. This vulnerability falls under CWE-125 (Out-of-Bounds Read) and CWE-129 (Incorrect Calculation of Buffer Size).

All installations of TimescaleDB with versions 2.29.1 or earlier that use dictionary compression in physical compressed relations. The affected code is in tsl/src/compression/algorithms/dictionary.c and the remediation involves fixing a bug in the reverse iterator path.

The CVSS score is 7.2 (Medium‑High severity). EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting current exploitation does not appear widespread. Attackers would need at least DML rights on a compressed table, which typically requires database-level privileges; they can then craft a datum and run a reverse-order scan to trigger the read. Given the severity and the need for non-privileged database access, the risk to a properly secured database is moderate, but an attacker with local or database access could leak sensitive backend memory.