The vulnerability is a buffer over-read in the ascii() function of PostgreSQL, which allows a crafted text value to expose up to three bytes past the end of the intended buffer. This flaw can reveal parts of memory that may contain sensitive data and therefore constitutes a confidentiality risk, though the impact is limited by the small amount of data that can be read.

The affected instances are PostgreSQL releases before 18.5, 17.11, 16.15, 15.19, and 14.24. All these versions allow the described flaw when an attacker supplies a specially crafted string to the ascii() function.

The CVSS score of 4.3 indicates moderate severity. EPSS is not available, suggesting the exploitation likelihood is not well quantified but may be low. The vulnerability is not listed in CISA's KEV catalog. Attackers would need the ability to execute arbitrary SQL commands against the database, implying either an authenticated privileged user or some form of SQL injection in a broader context. The risk is confined to the affected database instance, with no remote code execution or denial of service effect reported.