An integer wraparound flaw in PostgreSQL allows authenticated database users to perform out-of-bounds memory writes, potentially leading to arbitrary code execution or service disruption.

This is an integer overflow or wraparound vulnerability (CWE-190) within the tsvector and tsquery data type processing functions. An authenticated user with sufficient database access can send specially crafted large inputs to the server, causing an undersized memory allocation and subsequent out-of-bounds write.

This vulnerability carries a significant risk to database integrity and availability. An attacker could crash the database service, causing downtime, or potentially manipulate memory to execute arbitrary code. The CVSS score of 8.8 highlights the critical nature of memory corruption vulnerabilities within core database infrastructure.

Immediate Action: Update your PostgreSQL installation to the latest version, specifically those excluding the affected ranges mentioned in the vendor advisory.

Proactive Monitoring: Review database audit logs for unusual queries or repeated attempts to process exceptionally large or malformed tsvector inputs.

Compensating Controls: Restrict database access to trusted users only and enforce strict input validation at the application layer where possible to prevent malicious data from reaching the database engine.

Public Exploit Available: False

PostgreSQL is a critical component of many application stacks. Given the potential for arbitrary code execution, it is imperative that organizations prioritize patching their database instances to the recommended versions to eliminate this memory corruption vector.