This vulnerability in PostgreSQL's intarray extension arises from improper validation of the specified input type in the selectivity estimator function. An attacker with the ability to create objects in the database can exploit this flaw to execute arbitrary code as the OS user running the PostgreSQL server. The issue affects multiple major PostgreSQL versions prior to 18.2, 17.8, 16.12, 15.16, and 14.21. Red Hat advisories confirm the existence of this vulnerability and provide security updates to remediate it.

Successful exploitation allows arbitrary code execution with the privileges of the operating system user running the PostgreSQL database. This can lead to full compromise of the database server and potentially the host system. The CVSS v3.1 score is 8.8 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Security updates fixing this vulnerability have been released by PostgreSQL and are available through Red Hat advisories. Users should apply the official patches to PostgreSQL versions 14.21, 15.16, 16.12, 17.8, and 18.2 or later to remediate this issue. Patch status is confirmed by vendor advisories linked in the references. No additional mitigations are specified beyond applying these updates.