An integer wraparound flaw exists in several PostgreSQL server features that lets an unprivileged database user cause the server to allocate too little memory and then write beyond the end of that buffer. The out‑of‑bounds write can lead to execution of arbitrary code running with the operating system user account that owns the database process. For applications that supply gigabyte‑scale user data to the vulnerable functions, the flaw can also trigger a segmentation fault, potentially causing a denial of service. The vulnerability is a classic integer overflow problem, categorized as CWE‑190.

All PostgreSQL releases older than 18.4, 17.10, 16.14, 15.18, and 14.23 are affected. The issue affects the PostgreSQL server component of the database system and therefore any client or application that connects to it using a user account that does not have elevated privileges.

The CVSS score of 8.8 indicates a high severity, and the EPSS score is not available, meaning no current estimate of exploitation likelihood is published. The flaw is not listed in the CISA KEV catalog, but its impact is substantial. The likely attack vector, while not explicitly specified in the advisory, is inferred to be a database query executed by an unprivileged user who can supply large or crafted input that triggers the integer wraparound. Given the high impact, remediation should be prioritized.