The vulnerability is a buffer over-read in PostgreSQL’s pg_restore_attribute_stats() function. When the function receives an array of unmatched length during query planning, it reads past the end of the statistics array, exposing memory values that lie beyond the array’s boundary. The exposed data can be used by an attacker to infer internal database memory information, potentially revealing sensitive details about database internals. This weakness is classified as CWE-126.

PostgreSQL versions 18.0 through 18.3 are vulnerable. Any PostgreSQL 18.x installation that has not been updated to version 18.4 or later is affected. The vulnerability does not impact PostgreSQL releases prior to major version 18.

The CVSS score of 4.3 indicates moderate severity. No EPSS information is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation. The likely attack vector is local or authenticated access: an attacker with the ability to run a table maintenance operation on the database will trigger the vulnerability. To exploit the flaw, the attacker would need to supply a statistics array whose length does not match the expected size, causing the planner to read beyond the array’s bounds. The weakness does not allow remote code execution or privilege escalation, but it does provide a path for information leakage.