The vulnerability lies in PostgreSQL’s logical decoding component, where a missing authorization check allows any user with REPLICATION privileges, even if not a superuser, to choose a logical decoding plugin name. By supplying a specially crafted plugin name, the server bypasses its own safety checks and performs a dlopen call to load and execute arbitrary shared libraries. This effectively grants the attacker the ability to run arbitrary code on the OS account that runs the PostgreSQL process, leading to a potential compromise of confidentiality, integrity, and availability of the entire system. The weakness aligns with OWASP CWE‑862, Missing Authorization.

The issue affects PostgreSQL deployments prior to version 18.5, 17.11, 16.15, 15.19, and 14.24. All releases older than these milestones are vulnerable. The product is the official PostgreSQL database server distribution.

The CVSS score of 7.2 marks this as a High severity vulnerability. The EPSS score is not available, but the fact that the flaw permits arbitrary code execution under the server’s operating system user drastically increases the attack potential. The bug does not appear in the CISA KEV catalog, but any environment that grants REPLICATION rights to untrusted users remains at significant risk. Attackers need only a database account with REPLICATION privileges; they can then exploit the logical decoding interface to trigger the dlopen path and load malicious code.