An out-of-bounds write vulnerability exists in Pgpool-II, a middleware that works between PostgreSQL servers and a database client. This flaw may be exploited by an authenticated attacker to cause abnormal process termination or execute arbitrary code. The vulnerability affects Pgpool-II versions from 3.5.x up to and including 4.7.2. The CVSS 3.0 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to abnormal termination of Pgpool-II processes or arbitrary code execution, potentially compromising the database middleware's confidentiality, integrity, and availability. This could disrupt database operations or allow an attacker to execute malicious code within the context of Pgpool-II.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Pgpool-II to trusted authenticated users only and monitor for unusual process terminations. Do not assume a patch exists without vendor confirmation.