The PostgreSQL intarray extension includes a selectivity estimator that improperly accepts arbitrary input types, unvalidated. This flaw permits an object creator—a user with permissions to create objects within the database—to supply malicious data that triggers the estimator and ultimately leads to arbitrary code execution under the operating system user running PostgreSQL. The flaw represents a classic input‑validation weakness (CWE‑1287) and results in full control over the host where the database server runs. The likely attack vector is an object creator with appropriate privileges within the database.

Affected products are PostgreSQL database releases before 18.2, 17.8, 16.12, 15.16 and 14.21, covering eleven major releases. The vulnerability is present in the intarray extension as shipped with these versions and persists until the specified patch levels. Administrators using any of the listed versions should consider their system impacted.

The base CVSS score of 8.8 indicates high severity, yet the EPSS score of less than one percent suggests that current exploit activity is low but not impossible. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to act as an object creator within the database, a role typically granted to administrators but potentially reachable by privilege‑escalation attacks. Because the code runs with the operating‑system user privileges of PostgreSQL, successful exploitation results in full account compromise of that OS user.