The vulnerability arises from an integer wraparound in the fuzzystrmatch module of PostgreSQL, specifically in the levenshtein() and levenshtein_less_equal() functions. Exploiting this flaw enables an attacker to direct writes to a large range of memory addresses, potentially leading to arbitrary code execution with the privileges of the operating system user running the database. The issue affects multiple major PostgreSQL versions prior to the specified fixed releases.

Successful exploitation can lead to arbitrary code execution as the OS user running the PostgreSQL database, which can compromise the confidentiality, integrity, and availability of the database system and potentially the host system. The CVSS score of 8.8 reflects a high severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the current data. Users should monitor PostgreSQL vendor advisories for updates and apply official patches once available. Until then, restricting database user privileges and limiting access to the vulnerable functions may reduce risk.