Integer wraparound occurs in PostgreSQL's fuzzystrmatch extension when processing the levenshtein() and levenshtein_less_equal() functions with unusually large numeric arguments. The overflow turns the internal counter into a pointer that can be written to any 64‑bit memory location, allowing an attacker who can execute SQL commands to overwrite arbitrary data within the PostgreSQL process. This flaw enables the attacker to run arbitrary code with the privileges of the PostgreSQL operating‑system user, effectively compromising the database server and potentially the host operating system.

The vulnerability affects PostgreSQL releases earlier than 18.6, 17.11, 16.15, 15.19, and 14.24, meaning all versions below those points are at risk. The affected component is the fuzzystrmatch extension distributed with the PostgreSQL server.

With a CVSS score of 8.8 the flaw has a high functional impact, yet the EPSS score is < 1%, indicating a very low but nonzero exploitation probability. The attack likely requires a user with the ability to execute SQL commands against the database, either locally or over a network, and the ability to supply carefully crafted, large integer inputs to the levenshtein functions. Because the flaw allows arbitrary memory writes, successful exploitation leads to control over the PostgreSQL process and potential escalation to the operating‑system level.