A stack buffer overflow occurs in PostgreSQL’s argument name matching routine, allowing an object creator to write only 0x0 and 0x1 bytes via the OUT parameter count. The overwrite occurs on server memory and could corrupt stack data; the CVE description indicates that the exact impact is unknown but the nature of the flaw makes arbitrary code execution or other malicious activities a realistic possibility.

The vulnerability affects PostgreSQL database servers. Versions released before 18.5, 17.11, 16.15, 15.19, and 14.24 are impacted. No other vendors are listed.

The flaw has a CVSS score of 8.2, indicating a high severity interaction. The EPSS score is not available, and the vulnerability is not in CISA KEV. The likely attack vector involves an attacker with the ability to create database objects, such as by sending crafted SQL commands, potentially from a remote client if the database is exposed. Since the precise impact is unknown, the risk is still significant due to the nature of the buffer overflow and the high severity rating.