This vulnerability involves a heap buffer overflow in the plperl procedural language handler of PostgreSQL when returning a tied hash. An attacker who can create or modify a function body can exploit this flaw to execute arbitrary code as the OS user running the database process. The issue affects multiple major PostgreSQL versions prior to specific patch releases (18.5, 17.11, 16.15, 15.19, and 14.24). No vendor advisory or patch links were provided in the input data, and the remediation level is unspecified.

Successful exploitation allows arbitrary code execution with the privileges of the operating system user running the PostgreSQL database. This can lead to full compromise of the database server environment, including data theft, modification, or destruction, and potential lateral movement within the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official patches or updates are confirmed, restrict function creation and modification privileges to trusted users only and monitor for suspicious activity involving plperl functions.