This vulnerability is a type confusion flaw in the PostgreSQL 'refint' module, which can be exploited by an object creator to execute arbitrary code as the OS user running the database. The flaw arises from improper handling of resource types, leading to incompatible type access. The fix was merged in the PostgreSQL git repository as a removal of the plan cache in the 'refint' module, though it was initially tracked as a non-security bug and lacks a dedicated security advisory. Affected versions include all releases before 18.5, 17.11, 16.15, 15.19, and 14.24. No known exploits in the wild have been reported.

Successful exploitation allows an attacker with object creation privileges to execute arbitrary code with the operating system user privileges of the PostgreSQL server process. This can lead to full compromise of the database server environment, affecting confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the PostgreSQL vendor advisory and git repository for the latest remediation guidance. The fix was introduced as a non-security bug fix in the git repository, so upgrading to PostgreSQL versions 18.5, 17.11, 16.15, 15.19, or 14.24 and later is recommended once official releases including the fix are available. Until then, restrict object creation privileges to trusted users only.