Heap buffer overflow in PostgreSQL's pg_stat_statements extension allows a query author to execute arbitrary code as the operating system user that runs the database. The flaw is triggered by crafted SQL queries containing array constants, causing a heap buffer overflow (CWE‑122). All minor releases of PostgreSQL 18 before 18.6 are affected, while earlier major releases are safe. An attacker who can submit such queries can gain full control of the database server and potentially the underlying system, compromising confidentiality, integrity and availability of all data stored in the instance.

The vulnerability affects PostgreSQL major version 18, specifically minor releases before 18.6. Versions before PostgreSQL 18 are not affected. Any deployment running PostgreSQL 18.0 through 18.5 remains at risk.

The CVSS score of 8.8 indicates high severity, and the EPSS score of <1% suggests a very low but non‑zero likelihood of exploitation; the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker who can submit SQL queries containing the trigger payload; this could occur through a privileged client application or through any interface that permits executing arbitrary statements against the database.