PostgreSQL’s ECPG interface contains an integer underflow that enables a database server administrator to cause a temporary denial of service against the ECPG client by sending a bytea value that lacks the mandatory prefix. The client miscomputes a size and overwrites a large memory region with bytes that are not under the attacker’s control, typically resulting in a segmentation fault. In rare cases the overwrite may affect client-specific data, providing a weak integrity impact, but the primary effect is a client crash.

All PostgreSQL releases older than 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. Any client that uses the ECPG extension against a vulnerable server is at risk.

The CVSS score of 3.8 classifies the problem as low severity. The EPSS score is less than 1%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires a database server administrator or a privileged user who can send crafted queries; it does not require external network access. Exploitation results in a client crash rather than arbitrary code execution. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.