Buffer over-read in the PostgreSQL pg_trgm index picksplit function reads past the end of a heap buffer. This might allow a table maintainer to infer limited memory values via the lossy signal of index split choices, potentially exposing sensitive information. The vulnerability is a classic buffer over-read (CWE-126) and does not provide arbitrary code execution.

PostgreSQL databases running versions before 18.6, 17.11, 16.15, 15.19, or 14.24 are vulnerable. Users of older PostgreSQL releases should check their version against these thresholds.

The CVSS score of 4.3 indicates a moderate risk. EPSS score is less than 1%, indicating a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that exploitation would require table maintainer privileges, since the attacker must trigger an index split operation using pg_trgm. The vulnerability does not appear to be exploitable over the network by default.