TimescaleDB versions up to 2.29.1 contain an out‑of‑bounds read that allows an authenticated attacker to supply a specially crafted Simple8b selector‑11 value stored in the signed int16 Arrow dictionary‑index type. This input bypasses index validation during bulk text dictionary decompression, leading to query‑result integrity failures, incorrect aggregation output, or a backend crash. The vulnerability is triggered when the attacker performs DML on a non‑frozen compressed hypertable relation and exploits the VectorAgg single‑text hashing strategy, causing the database to read before the base of the live offsets array.

The affected product is TimescaleDB, with all releases through 2.29.1 at risk. The defect was fixed in commit 517c13e of the TimescaleDB repository, so versions newer than 2.29.1 are considered safe.

The CVSS score of 7.1 indicates a high severity, but there is no EPSS data and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated direct DML access to a non‑frozen compressed hypertable, so an attacker who already has database write privileges can trigger a denial‑of‑service event or cause incorrect query results. The system impact is likely limited to the compromised database instance, though a crash can incur downtime and data loss during recovery.