Improper handling of the OID vector data type in PostgreSQL allows a database user to read a small number of bytes from server memory. The disclosed data may contain sensitive information, though the likelihood of meaningful confidential data being exposed is considered low. The weakness is categorized as an information disclosure vulnerability.

PostgreSQL installations running any version earlier than 18.2, 17.8, 16.12, 15.16, or 14.21 are affected. Upgrading to the stated or later releases eliminates the flaw.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a valid database user; an attacker could craft queries that trigger the OID vector handling and read the exposed memory bytes. Given the limited data leakage and the requirement for database credentials, the overall risk to an organization without such credentials is relatively low, but environments with publicly accessible database services should consider mitigation promptly.