The vulnerability arises from a missing authorization check in PostgreSQL’s logical decoding module. A non-superuser with REPLICATION privileges can select any logical decoding plugin name, enabling the server to dlopen and execute an arbitrary file visible to the operating system user that runs the database process. The result is arbitrary code execution as that OS account, compromising confidentiality, integrity, and availability. The weakness corresponds to CWE-862, Missing Authorization. PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

The issue affects PostgreSQL deployments prior to version 18.6, 17.11, 16.15, 15.19, and 14.24. All releases older than these milestones are vulnerable. The product is the official PostgreSQL database server distribution.

A CVSS score of 7.2 marks this as a High severity vulnerability. The EPSS score of 0.00285 (0.285%) indicates a very low exploitation probability, but the flaw permits arbitrary code execution under the server’s operating system user, which significantly increases the attack potential. The bug does not appear in the CISA KEV catalog, but any environment that grants REPLICATION rights to untrusted users remains at significant risk. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. Attackers need only a database account with REPLICATION privileges; they can then exploit the logical decoding interface to trigger the dlopen path and load malicious code.