This vulnerability is a heap buffer overflow in the pgcrypto component of PostgreSQL that enables an attacker controlling ciphertext input to execute arbitrary code as the OS user running the database server. The flaw affects multiple major PostgreSQL versions before specific patch levels (18.2, 17.8, 16.12, 15.16, and 14.21). Red Hat advisories confirm the vulnerability and provide updated packages to remediate the issue. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows arbitrary code execution with the privileges of the database server user, potentially leading to full compromise of the database environment and underlying system. The vulnerability impacts confidentiality, integrity, and availability of the affected systems.

Official patches are available from PostgreSQL and Red Hat for affected versions. Users should apply updates to PostgreSQL versions 18.2, 17.8, 16.12, 15.16, or 14.21 or later as provided by their vendor. Refer to the Red Hat security advisories (e.g., RHSA-2026:4441) for detailed update instructions. No additional mitigation steps are indicated beyond applying these official fixes.