Stack buffer overflow in the PostgreSQL refint module enables an unprivileged database user to execute arbitrary code on the host operating system. In addition, if a column marked as a refint cascade primary key is user‑controlled, a separate SQL injection flaw permits the attacker to run arbitrary SQL as the database user performing the update. The combination of stack overflow (CWE‑121) and SQL injection (CWE‑89) could lead to full compromise of the database server and its underlying operating system.

All PostgreSQL versions earlier than 18.4, 17.10, 16.14, 15.18, and 14.23 that include the refint extension are vulnerable. This includes both enterprise and community deployments of PostgreSQL 14 through 18.

The vulnerability has a CVSS score of 8.8, indicating high severity, and while the EPSS score is not available, the flaw could be exploited by a local, unprivileged database user on systems with the refint module enabled. The attack vector is local, requiring the attacker to have database privileges to execute malicious statements against refint. If the refint cascade primary key is user‑controlled, the attacker can also inject SQL commands to execute arbitrary code within the database process. The issue is not listed in the CISA KEV catalog but the potential for OS-level compromise warrants urgent attention.