Heap buffer overflow in the PostgreSQL pg_trgm module enables an attacker with database access to write crafted byte patterns to heap memory. The vulnerability is triggered by a malformed input string and may result in memory corruption or code execution, potentially allowing privilege escalation. It is a classic buffer overflow weakness categorized as CWE-120 and CWE-122.

The affected product is PostgreSQL, versions 18.0 and 18.1. No other versions are reported as vulnerable.

The CVSS score of 8.2 signifies high severity. The EPSS score is reported as less than 1 %, indicating a very low but non-zero probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a remote attacker who can send a crafted SQL query to a PostgreSQL server that has the pg_trgm module enabled and whose user has sufficient privileges to invoke the vulnerable function. Attackers would need to construct a specific input pattern to trigger the overflow; however, the limited control over byte patterns does not rule out the feasibility of privilege escalation attacks.