Threats tagged 'ghsa-jvgx-qpg4-cv6w'

An integer wraparound vulnerability exists in PostgreSQL's tsvector and tsquery data type functions, allowing an unprivileged database user to cause undersized memory allocation and out-of-bounds writes via crafted large inputs. This can lead to arbitrary code execution as the operating system user running the database. The vulnerability affects PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24. Application users are unlikely to exploit this through typical application interfaces since these data types are usually sourced from application logic rather than direct user input.