This vulnerability involves a heap buffer overflow in PostgreSQL's regexp functionality, which can be triggered by text that bypasses encoding validation and is processed through pg_wchar, causing unexpected data growth. This flaw enables arbitrary code execution as the OS user running the database. It is related to a previous vulnerability (CVE-2026-2006) but distinct in its cause. Affected versions include all releases prior to 18.5, 17.11, 16.15, 15.19, and 14.24. No official patch or remediation guidance is currently confirmed.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the operating system user running PostgreSQL, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid processing untrusted or specially crafted regular expressions that could trigger this vulnerability. Monitor PostgreSQL vendor communications for updates and apply patches promptly once available.