A critical SQL injection vulnerability in PostgreSQL allows privilege escalation by object owners, potentially granting them superuser control over the entire database instance.

This is a classic SQL injection vulnerability (CWE-89) found within the EXTRACT function deparse mechanism. It allows a user who already possesses object ownership to execute malicious SQL, effectively elevating their privileges to superuser status.

The ability to escalate privileges to superuser allows an attacker to bypass all database security controls, potentially resulting in complete data theft, modification, or destruction. With a CVSS score of 8.8, this vulnerability poses a severe threat to the integrity and confidentiality of any application relying on the affected PostgreSQL versions.

Immediate Action: Apply the vendor-provided security patches by upgrading to the latest minor version for the respective major release (e.g., 18.5, 17.11, etc.).

Proactive Monitoring: Review database audit logs for anomalous SQL commands, specifically those involving the EXTRACT function or attempts to modify sensitive system objects.

Compensating Controls: Restrict the ability of users to create or define new objects if they do not strictly require such privileges, and enforce the principle of least privilege for all database accounts.

Public Exploit Available: Unknown.

Database administrators should treat this update with the highest urgency. Upgrade cycles for database engines should be accelerated to address this privilege escalation risk, ensuring that superuser access remains strictly controlled and monitored.