The vulnerability arises because PostgreSQL's amcheck extension does not clear an untrusted search path. A user who has been granted EXECUTE privilege on an amcheck function can set a malicious search_path before invoking the function. The function then runs arbitrary code with the privileges of the owner of any expression indexes it references, enabling the attacker to execute arbitrary functions as those owners. This issue is classified as CWE‑426: Untrusted Search Path.

PostgreSQL database server versions 18, 16, 15, and 14 are impacted. Within each major release, all minor releases before 18.6, 16.15, 15.19, and 14.24 are affected. PostgreSQL 17 is unaffected.

The CVSS base score is 3.8, indicating low impact. With an EPSS score of < 1% and absent from the CISA KEV list, the likelihood of exploitation is uncertain. The attack vector is local: an attacker must already have EXECUTE privileges on an amcheck function and must be able to set the search_path configuration for the session. Successful exploitation would allow the attacker to run arbitrary functions as the owners of expression indexes, effectively escalating privileges within the database.