Threats tagged 'ghsa-pg72-cwp9-g362'

A heap-based buffer overflow vulnerability exists in the PostgreSQL function tsvector_delete(). This flaw allows a database user with limited privileges to execute arbitrary code with the operating system user privileges running the database. The issue arises when processing a tsvector containing lexeme data with a nonstandard but valid ordering that triggers additional alignment padding. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The vulnerability has a high severity score of 8.8 and impacts confidentiality, integrity, and availability.