The vulnerability resides in PostgreSQL's handling of data definition commands for user‑defined types. A user who creates a type can then create objects that depend on that type or reference it in an expression without the database checking the USAGE privilege associated with the type. This omission allows the creator to cause a denial of service when subsequent ALTER or DROP commands are issued on that type. The attack exploits an authorization bypass (CWE-862) and results in the availability of the database service for operations involving the affected type.

The issue affects the official PostgreSQL distribution. Versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 are vulnerable. Systems running these releases should be considered impacted. Newer major versions contain the fix.

The CVSS score of 4.3 reflects a low severity rating, and the EPSS score is not available, so no current exploitation data exists. The vulnerability is not cataloged in the CISA KEV list. Attacks would require a user with the ability to create types, i.e., an authenticated database role with SELECT/CREATE privileges, and the attacker can trigger the denial by issuing ALTER/DROP commands after inducing a dependency. Because the flaw does not allow arbitrary code execution or data exfiltration, the risk is confined to availability for the affected database objects.