The flaw is a heap buffer overflow in PostgreSQL’s regular‑expression engine. When a query contains characters that do not pass the normal encoding validation, the data can grow unexpectedly during conversion through pg_wchar, allowing the query author to execute arbitrary code with the privileges of the database process, which runs as the operating system user.

PostgreSQL database instances running versions before 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. The vulnerability is specific to the standard PostgreSQL distribution.

The CVSS score of 8.8 indicates high severity for remote code execution, but the EPSS score is not available, so the exploitation probability is unknown. The vulnerability is not listed in CISA’s KEV catalog. The attack can be carried out by an attacker who can inject a crafted query through the database client, whether from a local or remote source, and trigger the overflow during regex processing.