This vulnerability arises from the use of an inherently unsafe function PQfn in PostgreSQL's libpq client library, which does not properly limit the size of data copied into client stack buffers in functions lo_export(), lo_read(), lo_lseek64(), and lo_tell64(). A malicious PostgreSQL server superuser can exploit this to send an arbitrarily large response, causing a stack buffer overflow on the client side. This can overwrite stack memory in client tools such as psql and pg_dump, potentially leading to arbitrary code execution. The vulnerability affects PostgreSQL versions before 18.4, 17.10, 16.14, 15.18, and 14.23. Exploitation requires user interaction in connecting to a malicious or compromised server. The CVSS v3.1 base score is 8.8 (high severity) with network attack vector, low complexity, high privileges required on the server, and user interaction required on the client. The scope is changed as the attack affects the client system. Red Hat and PostgreSQL have released patches addressing this issue.

A malicious PostgreSQL server superuser can exploit this vulnerability to overwrite client stack memory when a client connects using vulnerable versions of libpq functions. This can lead to arbitrary code execution on the client system, compromising confidentiality, integrity, and availability. The vulnerability affects client tools such as psql and pg_dump. Exploitation requires the client to connect to a malicious or compromised server and involves user interaction. No known exploits in the wild have been reported at this time.

A fix is available in PostgreSQL versions 18.4, 17.10, 16.14, 15.18, and 14.23 and later. Users should upgrade to these fixed versions or later. Until patched, users should avoid connecting to untrusted or potentially compromised PostgreSQL servers using psql, pg_dump, or other client tools that use the vulnerable libpq functions. The vendor advisory explicitly recommends only connecting to trusted servers as a mitigation. No other specific mitigations are noted.