This vulnerability involves an integer wraparound in PostgreSQL's tsvector and tsquery data type functions, which can cause undersized memory allocations and out-of-bounds writes when processing crafted large inputs. An unprivileged database user can exploit this to execute arbitrary code with the privileges of the database operating system user. The affected versions are those prior to PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24. The vulnerability is related to similar previously fixed issues (CVE-2026-6473). Exploitation via application users is considered unlikely because these data types are typically sourced from application logic rather than direct user input.

Successful exploitation allows an unprivileged database user to execute arbitrary code as the operating system user running the PostgreSQL server. This can lead to full compromise of the database server environment. The vulnerability affects confidentiality, integrity, and availability with high severity (CVSS 8.8).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the current data. Until a patch is available, restrict unprivileged database user permissions and monitor for unusual activity related to tsvector and tsquery usage. Application-level mitigations are unlikely to be effective since the vulnerability is in internal data type functions.