The vulnerability is a heap buffer overflow in PostgreSQL's pg_dump utility triggered by processing excessively long function transform lists. An attacker who can create or modify database objects can embed a crafted transform list that overflows a heap buffer, allowing them to execute arbitrary code as the operating system user running the pg_dump process. This flaw therefore enables compromise of the host system with the same privileges as the pg_dump user.

All PostgreSQL servers using version 18.5 or earlier, 17.10 or earlier, 16.14 or earlier, 15.18 or earlier, or 14.23 or earlier are affected. The flaw exists in the bundled pg_dump tool, so any system where that utility is available and executed by a user with sufficient OS permissions can be exploited. Versions 18.6, 17.11, 16.15, 15.19, and 14.24 and later contain the patch.

The overall CVSS score of 8.8 indicates a high severity. EPSS is less than 1%, suggesting a relatively low observed exploitation probability, and the vulnerability is not part of CISA’s KEV catalog. However, the attack vector is local: the exploit requires the attacker to run pg_dump from an account that has the same operating system privileges as the target. Because any database role with CREATE FUNCTION privilege can inject a malicious transform list, the reach of the flaw can be significant in environments where such privileges are granted broadly. The likely attack vector is local exploitation via pg_dump executed by the OS user—this inference is drawn from the description that execution occurs as the OS user running pg_dump, not from network input, and is not directly stated in the data. Organizations should treat this as a near-term high risk if pg_dump is run with elevated privileges and function creation rights are widely distributed.