Integer wraparound in the fuzzystrmatch extension’s levenshtein functions allows a database user to direct writes to arbitrary memory addresses, giving the attacker the ability to execute code as the operating‑system user running the PostgreSQL server. The flaw can be exercised by supplying extremely large input values to the levenshtein() or levenshtein_less_equal() SQL functions, which triggers a wraparound in an internal counter and corrupts memory. The result is a high‑severity code‑execution vulnerability with full compromise of the database system and the underlying host.

The vulnerability affects PostgreSQL releases earlier than 18.5, 17.11, 16.15, 15.19, and 14.24, meaning all versions below those points are at risk. The affected component is the fuzzystrmatch extension distributed with the PostgreSQL server.

With a CVSS score of 8.8 the flaw has a high functional impact, yet the EPSS is not available so exact exploitation probability is unknown. The attack likely requires a user with the ability to execute SQL commands against the database, either locally or over a network, and the ability to supply carefully crafted, large numeric inputs to the levenshtein functions. Because the flaw allows arbitrary memory writes, successful exploitation leads to control over the PostgreSQL process and potential escalation to the operating‑system level.