This vulnerability involves a heap buffer overflow in the pg_stat_statements extension of PostgreSQL. An attacker with the ability to author queries can exploit this flaw by submitting specially crafted queries containing array constants, leading to arbitrary code execution with the privileges of the database OS user. The issue is limited to PostgreSQL version 18 before 18.5; earlier major versions are not vulnerable.

Successful exploitation can lead to arbitrary code execution as the operating system user running the PostgreSQL database, potentially compromising the host system's confidentiality, integrity, and availability. The CVSS 3.1 score of 8.8 reflects high impact with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Users should monitor PostgreSQL advisories for updates and apply patches once available. Until then, restrict query authoring privileges to trusted users only.