The flaw is an integer wraparound in PostgreSQL’s tsvector and tsquery functions that forces the database to allocate an undersized buffer. An unprivileged database user can feed large crafted inputs that trigger an out‑of‑bounds write, enabling arbitrary code execution as the operating system user that runs the database service. Since these functions are typically sourced from application logic rather than user inputs, application users attacking through the application as a conduit are unlikely. Similar vulnerabilities were fixed in CVE‑2026‑6473.

PostgreSQL database servers are affected. All PostgreSQL releases prior to version 18.6, 17.11, 16.15, 15.19, and 14.24 contain the bug. These versions are typically accessed through application logic; however, any role that has permissions to execute tsvector or tsquery functions can trigger the issue.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score is below 1%, showing a very low probability of exploitation. The vulnerability is not listed in CISA KEV, indicating no known active exploitation. The likely attack vector involves an attacker with permissions to execute tsvector or tsquery functions who can supply crafted large inputs directly to the database, triggering the out‑of‑bounds write that can lead to arbitrary code execution as the operating system user that runs PostgreSQL. Because these functions are normally invoked from application logic, an attacker would need to obtain elevated database permissions or a compromised application, so direct attack by regular application users is unlikely.