The issue is a memory‑safety flaw in the pgx Go PostgreSQL driver that allows an out‑of‑bounds write (CWE‑787). A malformed response from a database could overwrite adjacent memory in the Go process, potentially enabling arbitrary code execution, data corruption, or denial of service for any application that links against pgx.

The vulnerability resides in the official pgx project under github.com/jackc/pgx/v5 and its pgproto3 component. The CNA does not provide specific version ranges, implying that any release of v5 containing the vulnerable code may be affected. Administrators should review their Go module dependencies to confirm whether the library is present in their builds.

With a CVSS score of 9.8 the flaw is considered critical, yet the EPSS score is below 1%. It is not listed in CISA’s KEV catalog. The likely attack path involves a crafted PostgreSQL payload processed by an application that uses pgx, which could allow an attacker to write arbitrary data to memory and potentially execute code. The risk remains significant for services exposed to untrusted database traffic, and urgent remediation is advised.