This vulnerability involves an integer wraparound in PostgreSQL's tsvector and tsquery data type functions that results in undersized memory allocation and out-of-bounds writes when processing crafted large inputs. An unprivileged database user can exploit this to execute arbitrary code with the privileges of the database server process. The flaw affects multiple PostgreSQL major versions prior to the specified patch levels. The vulnerability is similar to a previously fixed issue (CVE-2026-6473).

Successful exploitation can lead to arbitrary code execution with the operating system privileges of the PostgreSQL server process, resulting in full compromise of the database server. However, exploitation via typical application user input is unlikely because the vulnerable data types are generally derived from application logic, not direct user input.

A fix is available in PostgreSQL versions 18.6, 17.11, 16.15, 15.19, and 14.24 and later. Users should upgrade to these or newer versions to remediate the vulnerability. No additional mitigation guidance is provided or necessary beyond applying the official patches.