The vulnerability occurs when pglogical’s apply worker copies data without validating the length of certain fields in replication protocol messages, leading to an out‑of‑bounds read. An attacker can craft messages that cause the worker to read beyond a buffer and expose adjacent process memory or crash, impacting confidentiality and availability.

This flaw affects EnterpriseDB’s pglogical extension. Clients using the subscription feature, particularly those that allow arbitrary publishers, are at risk. Default installations restrict subscription creation to superusers, so the issue mainly concerns managed deployments that have delegated this privilege to non‑superuser roles.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score is below 1%, suggesting low probability of widespread exploitation. It is not listed in the CISA KEV catalog. Exploitation requires access to a subscription publish endpoint; the attacker would normally need superuser rights to create the subscription, making the attack surface narrower. Without such privileges, the vulnerability remains largely theoretical.