The reported issue is a memory‑safety flaw in the pgx v5 Go database driver. The vulnerability allows unchecked read or write operations on arbitrary memory regions, which can cause an application crash or leak sensitive data. The consequences influence the confidentiality, integrity, and availability of software that relies on the driver.

The flaw applies to the pgx_project’s v5 package and its nested pgproto3 module. No specific version range is noted, implying any deployment of pgx v5 that has not updated to the latest release may be vulnerable. This includes Go applications that import github.com/jackc/pgx/v5 directly or indirectly through other modules.

The CVSS score of 9.8 categorizes this as a critical vulnerability, while the EPSS score of less than 1% suggests that exploitation is currently rare. The most plausible attack path involves a malicious client sending crafted database or protocol frames to a Go service that uses pgx, resulting in memory corruption. Though the precise attack vector is not detailed in the description, this inference is based on the nature of the driver and typical client-server interactions.