The vulnerability arises from a flaw in PostgreSQL’s EXTRACT() expression deparse, which can be abused by an object owner to inject arbitrary SQL. The injected code runs with superuser privileges, enabling full compromise of the database system. The weakness is an instance of CWE‑89, a classic SQL injection scenario, granting attackers the ability to read, modify, or destroy data and disrupt database availability.

This flaw affects PostgreSQL distributions before version 18.5, 17.11, 16.15, 15.19, and 14.24. Any component that performs expression deparse is impacted, including core utilities such as pg_dump, psql commands like \sf, and non‑core tools that rely on the same functionality.

The CVSS score of 8.8 indicates a high severity, and although the EPSS score is not available, the vulnerability’s use in widely deployed tools suggests a realistic exploitation probability. It is not listed in the CISA KEV catalog. The likely attack vector is that an object owner creates a malicious object definition containing a crafted EXTRACT argument; when a tool or application later deparses that expression, the injected SQL is executed with superuser rights. No additional prerequisite conditions are stated, making the vulnerability broadly exploitable within any affected PostgreSQL instance where such objects exist.