The vulnerability is a type‑confusion bug in PostgreSQL’s pg_restore_attribute_stats() function. An object creator can trigger the conflation of range and multirange values to execute arbitrary code with the privileges of the operating system user that runs the database server. This flaw can allow an attacker to escape database isolation and run any code on the host, constituting a high‑severity remote code execution risk.

Only PostgreSQL instances running major version 18 with minor releases before 18.5 are affected. Versions earlier than major 18 are not vulnerable, while future minor releases starting at 18.5 contain the fix. Administrators should verify the exact minor version of their PostgreSQL installation before planning mitigations.

The CVSS score of 8.8 highlights that the flaw is of significant severity, though the EPSS score is not available and it is not listed in the CISA KEV catalog, indicating no reported exploitation at time of analysis. Because the vulnerability requires call access to the function by an object creator, the likely attack vector is through crafted SQL or administrative actions. Until a patch is released, revoking the public EXECUTE privilege on pg_restore_attribute_stats() is the recommended workaround, which limits the function to privileged users only.