This vulnerability involves type confusion in the management of PostgreSQL portals and cursors, which can be exploited by an attacker to execute arbitrary code with the privileges of the OS user running the database process. The flaw arises when a cursor or portal is recreated with different data types, leading to unsafe memory access. Affected versions include all releases prior to 18.5, 17.11, 16.15, 15.19, and 14.24. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided, so remediation status is unknown.

Successful exploitation can lead to arbitrary code execution with the operating system privileges of the PostgreSQL server process, potentially allowing full compromise of the database server environment. The vulnerability affects confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to trusted users only and monitor for suspicious activity related to cursor or portal usage.