The vulnerability arises from the use of the inherently unsafe PQfn function in PostgreSQL's libpq client library, specifically when result_is_int=0 is used. This function stores server-determined data of arbitrary length into a client buffer without size checks, similar to the unsafe gets() function. The affected client functions (lo_export(), lo_read(), lo_lseek64(), lo_tell64()) can be exploited by a server superuser to send oversized responses that overwrite the client's stack memory. This impacts client tools such as psql and pg_dump, potentially allowing arbitrary code execution on the client system. The vulnerability affects PostgreSQL versions before 18.4, 17.10, 16.14, 15.18, and 14.23. Red Hat's advisory confirms the issue and provides updated libpq packages to remediate the flaw. Exploitation requires user interaction (connecting to a malicious server), and the scope is changed as the attack affects the client rather than the server.

The vulnerability allows a PostgreSQL server superuser to cause a buffer overflow on the client side, overwriting stack memory in client applications such as psql and pg_dump. This can lead to arbitrary code execution on the client system, compromising confidentiality, integrity, and availability. The attack requires the client to connect to a malicious or compromised server, meaning the threat is primarily to clients connecting to untrusted servers. The CVSS v3.1 score is 8.8 (high), reflecting network attack vector, low complexity, high privileges required on the server side, user interaction required, and high impact on confidentiality, integrity, and availability.

A fix is available and has been released by Red Hat in updated libpq packages for affected Red Hat Enterprise Linux versions (notably RHEL 8.6). Users should apply these updates promptly. Additionally, clients should avoid connecting to untrusted or potentially compromised PostgreSQL servers to mitigate risk. The vendor advisory explicitly recommends only connecting to trusted servers and updating to patched versions. No other mitigations are specified.