This vulnerability involves type confusion in the input handling of the ctid data type selectivity estimator in PostgreSQL. An attacker with object creation privileges can supply a non-ctid input to cause the system to perform a calculation on an arbitrary 4-byte memory segment. Although the calculation loses precision, it can still reveal substantial memory values. The flaw affects multiple major PostgreSQL versions prior to their respective patch releases 18.5, 17.11, 16.15, 15.19, and 14.24. No official remediation level or patch links are provided in the data, so patch status is not confirmed.

The vulnerability allows an attacker with object creation privileges to access memory content indirectly via a type confusion bug. This can lead to partial disclosure of memory values, potentially exposing sensitive information. The CVSS score of 8.1 indicates a high severity impact with network attack vector, low attack complexity, and no user interaction required. The impact includes high confidentiality loss and high availability impact, but no integrity impact is indicated.

Patch status is not yet confirmed — check the official PostgreSQL vendor advisory for current remediation guidance. Until patches are confirmed and applied, limit object creation privileges to trusted users only to reduce risk.