A heap buffer overflow in the PostgreSQL pgcrypto extension permits an attacker who can supply ciphertext to the database to execute arbitrary code as the operating system user running PostgreSQL.

PostgreSQL versions earlier than 18.2, 17.8, 16.12, 15.16, and 14.21 are affected; affected installations must upgrade to the corresponding release or newer.

The likely attack vector is the delivery of specially crafted ciphertext to pgcrypto, which triggers the overflow; an attacker needs database access to send such data. The flaw carries a CVSS score of 8.8, indicating high severity, while the EPSS score of <1% suggests a relatively low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but successful exploitation would allow code execution with the privileges of the database process.