PostgreSQL’s ECPG interface contains an integer underflow that the database server can exploit by sending a bytea value that lacks the required prefix. The client incorrectly calculates a size and overwrites a large region of memory with arbitrary bytes, typically delivering a segmentation fault. In uncommon cases the memory write could also affect other client data, providing a weak integrity impact. The result is a temporary denial of service against the ECPG client.

All PostgreSQL releases older than 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. Any client that uses the ECPG extension against a vulnerable server is at risk.

The CVSS score of 3.8 classifies the problem as low severity, and no EPSS score is available. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires a database server administrator or a privileged user who can send crafted queries; it does not require external network access. Exploitation results in a client crash rather than arbitrary code execution.