This vulnerability involves integer wraparound in several PostgreSQL server features, enabling an unprivileged user to trigger undersized memory allocations and out-of-bounds writes. This can lead to arbitrary code execution as the OS user running PostgreSQL. Additionally, large user inputs to these functions may cause segmentation faults in applications. The issue affects PostgreSQL versions before 18.4, 17.10, 16.14, 15.18, and 14.23. The CVSS v3.1 base score is 8.8, reflecting high severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction.

Successful exploitation can result in arbitrary code execution with the privileges of the PostgreSQL server process, which may lead to full compromise of the database server environment. Additionally, applications passing large inputs to the vulnerable functions may crash due to segmentation faults. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the official PostgreSQL vendor advisory for current remediation guidance. The affected versions are prior to PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23, so upgrading to these or later versions may address the issue once official patches are released. Until then, monitor vendor communications for updates.