The vulnerability arises because PostgreSQL does not verify that a role creating a user‑defined type has the proper CREATE privilege on the target schema. An attacker who can create a type can manipulate internal search_path logic to cause a victim database session to execute arbitrary SQL functions chosen by the attacker, leading to potential data disclosure, tampering, or denial of service. The flaw is classified as CWE‑862.

PostgreSQL versions before 18.4, 17.10, 16.14, 15.18, and 14.23 are affected. The issue is localized to the PostgreSQL database engine and does not impact other products.

The CVSS score of 5.4 indicates moderate severity; the EPSS score is currently unavailable and the vulnerability is not listed in the CISA KEV catalog, implying no known public exploits. Exploitation requires a role with CREATE TYPE capability, which is typically restricted to privileged accounts or application contexts. While the attack vector is not stated explicitly, it is reasonable to infer that local or application‑level exploitation is possible, as the flaw relies on internal privilege misuse rather than remote network access. Nevertheless, arbitrary SQL execution represents a significant risk to confidentiality, integrity, and availability.