A critical vulnerability in the PostgreSQL intarray extension allows authenticated attackers to execute arbitrary code, potentially leading to full system compromise.

This vulnerability involves improper validation of input types within the intarray extension, which can be triggered by an authenticated database user to achieve arbitrary code execution on the underlying host operating system.

The ability to execute arbitrary code as the operating system user running the database represents a total compromise of the database server. Given the CVSS score of 8.8, this flaw poses a severe risk to data confidentiality, integrity, and availability, as an attacker could gain persistent access to the server, exfiltrate sensitive data, or disrupt critical business operations.

Immediate Action: Upgrade to PostgreSQL versions 18.2, 17.8, 16.12, 15.16, or 14.21, as these releases contain the necessary security fixes for the intarray extension.

Proactive Monitoring: Audit database logs for unusual object creation activities or unexpected function calls involving the intarray extension that deviate from standard operational patterns.

Compensating Controls: Restrict the ability of database users to create objects or execute extensions unless strictly required for their role, and ensure the database service runs with the minimum necessary operating system privileges.

Public Exploit Available: Unknown

This vulnerability is highly severe due to the potential for full host system compromise. Administrators should prioritize patching all affected PostgreSQL instances immediately, ensuring that the updated versions are deployed across all production environments to eliminate the risk of arbitrary code execution.