The vulnerability arises from an untrusted search path in the amcheck extension of PostgreSQL. A grantee with EXECUTE privilege on the amcheck function can manipulate the search path to execute arbitrary functions with the privileges of the owners of expression indexes that depend on the search path. This issue affects PostgreSQL major versions 14, 15, 16, and 18 before minor versions 14.24, 15.19, 16.15, and 18.5 respectively. PostgreSQL 17 is unaffected. The CVSS 3.1 base score is 3.8, indicating low severity, with network attack vector, low attack complexity, high privileges required, no user interaction, and limited confidentiality and integrity impact.

An attacker with EXECUTE privilege on the amcheck function can execute arbitrary functions as the owners of expression indexes, potentially leading to unauthorized actions with elevated privileges. The confidentiality and integrity impacts are limited, and there is no impact on availability. The vulnerability requires high privileges and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor PostgreSQL vendor advisories for updates and apply official patches once available. Until then, restrict EXECUTE privileges on the amcheck function to trusted users only.