A flaw in PostgreSQL Anonymizer’s anon.anonymize_database_parallel() function permits a table owner to execute arbitrary code with superuser privileges. This allows the attacker to elevate their database permissions and run any command available to a superuser, potentially compromising the entire database instance.

The vulnerability targets the DALIBO PostgreSQL Anonymizer extension. Any installation that has not been upgraded to version 3.2.0 or later is susceptible, regardless of PostgreSQL version, but the issue is fixed in releases starting with 3.2.0.

The CVSS score of 6.4 indicates moderate severity. Exploitability details are not publicly available, and the vulnerability does not appear in the CISA KEV catalog. Based on the description, the attack vector is likely limited to users with table ownership who can invoke anon.anonymize_database_parallel(); the attacker would need to trigger the function through legitimate database operations to exploit the flaw.