A critical heap buffer overflow in the PostgreSQL pg_stat_statements module enables authenticated attackers to execute arbitrary code with database service privileges.

The vulnerability exists within the pg_stat_statements module and is triggered by processing crafted queries containing array constants. The attack vector requires the user to have the ability to execute queries, which constitutes an authenticated privilege level.

The impact of this vulnerability is severe, as it allows for arbitrary code execution under the context of the database service account. This can lead to total loss of confidentiality, integrity, and availability of the database system. With a CVSS score of 8.8, this flaw necessitates urgent attention to prevent unauthorized access or system-wide compromise.

Immediate Action: Update PostgreSQL installations to version 18.5 or the latest available maintenance release to address the overflow vulnerability.

Proactive Monitoring: Review database logs for malformed or unusually structured queries, particularly those involving array constants, which may indicate an attempt to trigger this heap overflow.

Compensating Controls: Implement strict input validation for database queries and ensure that database users are granted only the minimum necessary privileges to perform their required tasks.

Public Exploit Available: No

The risk posed by this heap buffer overflow is substantial. Administrators are strongly advised to apply the vendor-provided updates immediately to secure their database environments against potential remote code execution.