Heap buffer overflow in PostgreSQL's pg_stat_statements extension allows a query author to execute arbitrary code as the operating system user that runs the database. The flaw is triggered by crafted SQL query strings that contain array constants, overflowing a heap buffer (CWE‑122). If exploited, the attacker can gain full control over the database server and potentially the underlying system, compromising confidentiality, integrity, and availability of all data stored in the instance.

The vulnerability affects PostgreSQL major version 18, specifically minor releases prior to 18.5. Versions before PostgreSQL 18 are not affected. Thus any deployment running PostgreSQL 18.0 through 18.4 remains at risk.

The CVSS score of 8.8 indicates high severity, and the lack of an EPSS score means current exploitation probability is unknown, but the issue is not yet listed in CISA KEV. The likely attack vector involves an attacker who can submit SQL queries containing the trigger payload; this could occur through a privileged client application or through any interface that permits executing arbitrary statements against the database.