The vulnerability arises because PostgreSQL's amcheck extension does not clear an untrusted search path. A user who has been granted EXECUTE privilege on an amcheck function can set a malicious search path before invoking the function. The function then runs arbitrary code with the privileges of the owner of any expression indexes it references, enabling the attacker to execute arbitrary functions as those owners.

PostgreSQL database server versions 18, 16, 15, and 14 are impacted. Within each major release, all minor releases before 18.5, 16.15, 15.19, and 14.24 are affected. PostgreSQL 17 is unaffected.

The CVSS base score is 3.8, indicating moderate impact. With no EPSS data and absent from the CISA KEV list, the likelihood of exploitation is uncertain. The attack vector is local: an attacker must already have EXECUTE privileges on an amcheck function and must be able to set the search_path configuration for the session. Successful exploitation would allow the attacker to run arbitrary functions as the owners of expression indexes, effectively escalating privileges within the database.