Type confusion in PostgreSQL portal and cursor lifecycle permits an attacker to run arbitrary code as the database service's operating system user by recreating a cursor or portal with a different type. The flaw arises during the CLOSE and DECLARE steps of portal management, allowing malicious SQL to trigger native code execution with the privileges of the database process.

PostgreSQL database servers prior to versions 18.6, 17.11, 16.15, 15.19, and 14.24 are vulnerable. The issue applies to all installations that use cursor or portal functionality. The vendor name is PostgreSQL.

The CVSS score of 8.8 indicates high severity. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw via remote SQL connections that issue CLOSE and DECLARE commands on cursors. The vulnerability requires database‑level access and the ability to manipulate cursors; once exploited, code runs with the database service’s operating system privileges, potentially resulting in full system compromise.