The flaw is an integer wraparound in PostgreSQL’s tsvector and tsquery functions that forces the database to allocate an undersized buffer. An unprivileged database user can feed abnormally large inputs that trigger an out-of-bounds write, enabling arbitrary code execution as the operating system user that runs the database service. The weakness is a classic integer over‑wrap bug (CWE-190). Similar vulnerabilities were fixed in CVE-2026-6473.

PostgreSQL database servers are affected. All PostgreSQL releases prior to version 18.5, 17.11, 16.15, 15.19, and 14.24 contain the bug. These versions are typically accessed through application logic; however, any role that has permissions to execute tsvector or tsquery functions can trigger the issue.

The CVSS score of 8.8 signifies a high severity vulnerability. EPSS is not available, making it unclear how frequently attackers exploit this flaw. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known active exploitation. The attack vector involves an attacker who can submit crafted large inputs either directly to the database functions or indirectly through application logic. While the most direct path is via a database user with function invocation rights, a compromised application could potentially deliver the input. Successful exploitation would likely result in full compromise of the database server, including data disclosure, modification, and arbitrary system code execution.