A critical integer wraparound flaw in the PostgreSQL fuzzystrmatch extension permits authenticated users to execute arbitrary code on the database server.

The vulnerability exists within the fuzzystrmatch module, specifically in the levenshtein and levenshtein_less_equal functions. By providing extreme inputs, an authenticated user can trigger an integer wraparound that facilitates memory corruption and subsequent arbitrary code execution.

With a CVSS score of 8.8, this vulnerability represents a significant risk to the host server. The ability to execute arbitrary code allows an attacker to bypass standard database security controls, potentially leading to full system takeover. This could result in severe operational disruption and the loss of sensitive data stored within the database environment.

Immediate Action: Update PostgreSQL to the latest version (e.g., 18.5, 17.11, 16.15, 15.19, or 14.24) to patch the fuzzystrmatch module.

Proactive Monitoring: Monitor database query logs for unusual or excessively long inputs directed at the levenshtein or levenshtein_less_equal functions.

Compensating Controls: If immediate patching is not possible, disable the fuzzystrmatch extension to prevent abuse of the vulnerable functions.

Public Exploit Available: No

Administrative teams must apply the relevant security patches immediately to eliminate this attack vector. Disabling the affected extension is a viable temporary measure for systems where an immediate upgrade is not feasible but the functionality is not strictly required for operations.