This vulnerability is a type confusion flaw in PostgreSQL that permits a database user to invoke functions involving the "internal" data type. The "internal" type represents a set of structures not intended for SQL exposure; the mismatch between the expected and supplied data leads PostgreSQL to execute arbitrary code with the privileges of the OS account running the database. An attacker that can create or call such a function can completely compromise the database server and the underlying host.

PostgreSQL database servers prior to version 18.5, 17.11, 16.15, 15.19, or 14.24 are affected. All supported releases before these point releases contain the flaw, regardless of operating system.

The CVSS score of 8.8 reflects high severity and full exploitation potential. Although the EPSS score is unavailable, the flaw is not listed in the CISA KEV catalog, yet the availability of a high‑impact vulnerability indicates that it could be abused in the wild. The attack vector requires a user to invoke a function with an internal argument, which is possible for any database user with the appropriate privileges. Once invoked, the attacker gains operating‑system level code execution, making the risk extremely high for untrusted or poorly isolated database users.