Type confusion in PostgreSQL cursors allows an attacker to execute arbitrary code as the database operating system user by re‑creating a cursor with a different type. The flaw occurs during the CLOSE and DECLARE phases of portal lifecycle, enabling malicious SQL to trigger native code execution with the database process’s privileges.

PostgreSQL database servers prior to versions 18.5, 17.11, 16.15, 15.19, and 14.24 are vulnerable. The issue applies to all installations that use cursor or portal functionality. The vendor name is PostgreSQL.

The CVSS score of 8.8 indicates high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw via remote SQL connections that issue CLOSE and DECLARE commands on cursors. The vulnerability requires database‑level access and the ability to manipulate cursors; once exploited, code runs with the database service’s operating system privileges, potentially resulting in full system compromise.