Integer wraparound in 32‑bit builds of the pltcl and plperl procedural languages in PostgreSQL allows an object creator to cause a negative allocation size during function body parsing, which leads to an out‑of‑bounds write. The attacker can overwrite memory and execute arbitrary code as the operating system user that owns the database server. The flaw stems from unchecked integer arithmetic (CWE‑190).

PostgreSQL 32‑bit installations that include the pltcl and plperl extensions are vulnerable. Versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. The issue does not exist in newer releases or in 64‑bit builds.

The CVSS score of 8.8 classifies this vulnerability as high severity. EPSS data is not available, but the missing database level privilege escalation pathway indicates potential for exploitation if the attacker can create functions. It is not listed in CISA’s KEV catalog, so no known active exploits are reported. The likely attack vector is via crafted function bodies submitted by a user with privileges to create or alter extensions, after which malicious code would run with database server privileges.